Keyorix

Paid APILinuxMacSelf-hostedWeb

What Keyorix is

Keyorix is free, open-source software for managing secrets, keys, and certificates when a team cannot use SaaS. It is self-hosted, delivered as a single binary, and described as ready for air-gapped environments; the core product needs no internet access. Teams can create, read, update, delete, and version secrets across development, staging, and production. Role- and group-based permissions, CI/CD service tokens, dynamic secrets with time-to-live, and CLI injection as environment variables support access workflows. REST, GraphQL, and CLI interfaces are available, with SDKs for Go, Python, Node.js, and Java. Named environments and integrations include Git, CI/CD, Kubernetes, cloud, Web3, edge, and IoT. Keyorix records who accessed what, when, and from where, and alerts on secrets nearing rotation. The repository states that values use AES-256-GCM encryption and are not logged or exposed in errors. It uses AGPL-3.0; commercial licenses are offered for organizations unable to use AGPL.

Who it suits

Keyorix is aimed at security teams, startups, and enterprises that need self-hosted or air-gapped secrets management. It fits organizations integrating credentials with CI/CD, Kubernetes, cloud, edge, or IoT systems.

What it does well

Air-gapped deployment needs no internet access
Supports secret versioning across environments
Provides REST, GraphQL, and CLI interfaces
Includes Go, Python, Node.js, and Java SDKs
Audit logs record access details

What to know first

AGPL-3.0 may not fit every organization
Commercial licensing is separate for some users
Self-hosted deployment requires infrastructure management

Verdict

Keyorix focuses on locally controlled secrets management with broad interfaces, access policies, auditing, and dynamic credentials. Its licensing and self-hosted model should be reviewed before adoption.

Facts from Keyorix's own pages

Access control: The repository lists role-based and group-based permissions, service tokens for CI/CD, and dynamic secrets with time-to-live. · github.com, 11 Oct 2026
Air-gapped use: The repository says the core product needs no internet access and supports air-gapped deployment. · github.com, 11 Oct 2026
Audit: Keyorix says it logs who accessed what, when, and from where, and provides dashboard alerts for secrets nearing rotation deadlines. · github.com, 11 Oct 2026
Compliance: The maker lists NIS2, DORA, the AI Act, GDPR, and ENS under “EU Compliance-by-Design.” · keyorix.com, 11 Oct 2026
Deployment: The project describes itself as on-premise, air-gap ready, and available as a single binary. · github.com, 11 Oct 2026
Encryption: The repository says secret values are encrypted with AES-256-GCM and that secrets are not logged or exposed in error messages. · github.com, 11 Oct 2026
Headquarters: Valencia, Spain · keyorix.com, 28 Sept 2026
Health scan: The maker offers a free, read-only Vault and OpenBao health scan that does not read secret values or send telemetry. · keyorix.com, 11 Oct 2026
Integrations: The maker lists Go, Python, Node.js, and Java SDKs and an MCP server with read-only secret tools. · github.com, 11 Oct 2026
Intended users: The repository describes Keyorix as lightweight on-premise secrets management for European enterprises. · github.com, 11 Oct 2026
Interfaces: The maker's site lists REST and GraphQL interfaces and a CLI. · keyorix.com, 11 Oct 2026
License and commercial terms: The software is released under AGPL-3.0, and the maker says commercial licenses are available for organizations that cannot use AGPL. · keyorix.com, 11 Oct 2026
Migration: The project documents importing from Vault exports and .env files, and provides a separate migration binary for live Vault, OpenBao, and cloud secret managers. · github.com, 11 Oct 2026
Privacy: The privacy policy says the software is self-hosted, sends no telemetry or license-check calls, and keeps secrets and data in the user's infrastructure. · keyorix.com, 11 Oct 2026
Privacy policy: The website privacy policy says it collects information submitted through its forms and does not use analytics, advertising, or tracking cookies. · keyorix.com, 11 Oct 2026
Product: Keyorix describes itself as open-source secrets management for teams that cannot use SaaS. · github.com, 11 Oct 2026
Purpose: Keyorix is a secrets, keys, and certificates management platform designed for teams that cannot use SaaS. · github.com, 11 Oct 2026
SDKs: The repository lists Go, Python, Node.js, and Java SDKs. · github.com, 11 Oct 2026
Secret handling: Secrets can be injected into applications as environment variables through the CLI. · github.com, 11 Oct 2026
Secret management: The product supports creating, reading, updating, deleting, and versioning secrets, with development, staging, and production environments. · github.com, 11 Oct 2026
Security: The maker says access actions use cryptographic proofs and zero-knowledge protocols, and that interactions can be verified without exposing sensitive data. · keyorix.com, 11 Oct 2026
Support: The terms say paid services such as support are governed by a separate written agreement. · keyorix.com, 11 Oct 2026
Zero trust: The maker says short-lived credentials and cryptographic proofs continuously verify access across cloud, on-prem, edge, and IoT nodes. · keyorix.com, 11 Oct 2026

Where Keyorix stands on Freedom251

Secrets Management Tools#34 of 46