Skip to content
OutRay

Your app needs secrets. Your codebase doesn’t.

Keep credentials out of repos, group chats, and shell history. Give every environment its own source of truth.

Get startedRead the docs

Stop passing .env files around.

One quick ask turns into a credential in a group chat. Now nobody knows which version is current.

  1. Amara Okafor

    Anyone got the latest production Stripe key? Mine stopped working after the rotation.

  2. Tobi Oladele

    This one? Delete it when you’re done.

    production.envpasted
    STRIPE_SECRET_KEY=sk_live_••••••••
  3. Nneka Eze

    Wait. Is that production or staging? 3

  4. Amara Okafor

    My .env has a different value…

Secrets change.
Your workflow keeps moving.

One vault. Separate environments. Straight to your app.

checkout

Environment vault
Encrypted
Development6 secrets
  • DATABASE_URL••••••••••••
  • REDIS_URL••••••••••••
  • SESSION_SECRET••••••••••••
  • STRIPE_SECRET_KEY••••••••••••
  • OBSERVABILITY_TOKEN••••••••••••
  • WEBHOOK_SECRET••••••••••••
Values hidden by default

Update a secret. Stay in flow.

Watch mode polls for changes and restarts your app with fresh values.

~/checkout
outray secrets run --watch \
  --org acme \
  --vault checkout \
  --env development \
  -- npm run dev
6 values delivered to the child process
Your applicationnpm run dev
Watching for changes
Explore CLI workflows

Share a secret.
Not a seat.

Share selected secrets without inviting someone to your organization.

  • Encrypted snapshots, not your live vault.
  • Set an expiry and a reveal limit.
  • Revoke access to future reveals.
Explore secret sharing
Active

A private handoff.

3 selected values from checkout

Private viewing linkEncrypted
API_BASE_URL
••••••••••••
SERVICE_NAME
••••••••••••
NODE_ENV
••••••••••••
Expires in 1 day3 reveals left

An encrypted snapshot. Not a live connection to your vault.

A way back.
Built into every change.

See who changed a secret and when. Restore an earlier value without losing the history.

Restore individual secret versions.

Previous versions stay in your history.

Explore version history
DATABASE_URLcheckout / Production
Version 3Updated
••••••••••••••••••••••••Value hidden
Changed by
Akin
Recorded
Oct 15, 09:32

Access, without all-access.

Give each runner the permissions it needs, scoped to a vault or environment.

Production deploy
Active
secrets:readRead only
Vault
checkout
Environment
Production
Expires in
30 days
No write or delete permissions
Explore machine tokens

Know who touched what.
And when.

Follow recorded actions, with their actor, target, and time. Not the secret value.

October 15Production
  1. AkinUpdated DATABASE_URL
  2. Production deployRead 6 secrets
  3. AkinRevealed WEBHOOK_SECRET
Explore the audit trail

Delete your .env file today.

Create a vault, add your first environment, and run your app with the right secrets.

Get startedRead the docs