Stop pasting secrets

Keyit exists because teams keep doing the same embarrassing thing: someone needs .env.local, so somebody pastes it into chat, a ticket, a doc, or a "temporary" file that becomes permanent.

Keyit gives that file a protocol. One approved device pushes an encrypted revision. Another approved device pulls it. The relay stores ciphertext and public metadata; it never gets a plaintext value or an unwrapped data key.

No accounts. No OAuth ceremony. No dashboard pretending to be the product. Identity is a device key pair generated locally the first time this machine needs Keyit state.

Know the boundary

Keyit moves developer-machine dotenv files. It is not a runtime secrets manager, not a KMS, and not a credential-rotation system.

The shortest path

brew tap simplbase/tap
brew install keyit
keyit relay check
keyit init --project-label my-project
keyit env add development .env.local
keyit push development --summary "Initial development env"

On another approved device:

keyit pull development

That's push and pull. Getting a second device approved to receive that pull is a separate step; see Concepts for the invite/join/approve model. That is the point: state moves only after the project says which devices are allowed to receive it.

Read in this order

Quickstart

Run the fake loop. No real secrets, no hosted relay, no excuses.

Installation

Get the binaries onto the machine without learning a platform.

First Project

What init writes, what you commit, and what stays local.

Concepts

The vocabulary behind devices, environments, revisions, invites, and relays.

What Keyit is not

Keyit is not a cloud secrets manager, not a KMS, and not a vault replacement. It solves a narrower problem: getting the same project-local dotenv file onto another approved machine without turning Slack into your incident report.

Choose a relay

Every new project defaults to the hosted relay at https://relay.keyit.sh. Use it when you want the cheap path: no setup, no server, just encrypted transport. Run keyit-relay yourself when you need control over where relay data lives. Either way, the relay is untrusted by design.