KeyRack

KeyRack is a self-hosted coordination layer for teams managing key hierarchies and cryptographic operations across their own infrastructure. It suits operators with an existing identity provider, policy service and key backend; its free core is capable, but it is neither a hosted KMS nor a turnkey security boundary.

Overview

KeyRack coordinates key use and rotation while delegating cryptographic work to backends such as PKCS#11, HashiCorp Vault Transit, a KMIP client or in-process software for development and testing. That makes it a fit for organizations seeking control over where keys reside, rather than a managed cloud service. With non-exportable keys in an HSM or Vault provider, raw key material stays there; authorized export operations can move exportable keys out.

Self-deployment also means operating and securing the service yourself. KeyRack does not include an identity provider, and authorization depends on an external policy decision point. Its REST listener serves plain HTTP and gRPC TLS is opt-in, so the maker recommends terminating HTTPS at a reverse proxy. Teams that need encrypted listeners configured by default should account for this before deployment.

Key features

Hierarchies and authorization

KEK-wrapping hierarchies, namespace-scoped rules and cascade operations provide a structure for organizing keys and applying changes across related keys. Authorization is checked on every operation and delegated to a policy decision point such as Cedar or OPA. This separation suits teams with established policy controls, but adds a dependency for those that do not already run such a service.

Audit and custody

Audit events can flow to NATS, files or stdout and use BLAKE3 hash-chain linking; Ed25519 signing is optional. These are useful controls for teams building audit pipelines, though the signing step must be enabled deliberately. Key custody depends on the backend and key configuration: non-exportable keys remain in an HSM or Vault provider, while authorized exports can release exportable material.

Integrations and identity

OIDC-compliant identity providers can include Keycloak, Auth0, Okta, Azure AD or Google Identity Platform. Commercial extensions add AWS KMS and OpenStack Barbican shims, accepting standard AWS SDK requests and exposing the Barbican REST API respectively. GCP Cloud KMS and Azure Key Vault shims are roadmap items, not working integrations today, which rules KeyRack out for teams that require either one now.

Pricing

The Open source core costs nothing and is self-deployed under AGPL-3.0-or-later. It is the natural starting point for teams that can operate the core and do not need commercial extensions.

Commercial licensing uses custom pricing, billed by contacting KeyRack for pricing and evaluation access. It includes HA clustering, key pooling, the AWS KMS and Barbican shims, a management UI, vendor HSM adapters and a KMIP server. This tier is aimed at organizations that need those operational and integration capabilities; the free core gives them up.

Platforms

KeyRack is offered as an API and self-hosted software. It is deployed in your infrastructure, not provided as a hosted cloud KMS.

Who it's for

The maker identifies regulated industries, multi-cloud platforms, SaaS providers using HYOK and OpenStack operators as audiences. It is most compelling for teams in those settings that already have identity and policy services and want backend choice with customer-managed keys. Those seeking a managed service, bundled identity, or implemented GCP and Azure KMS shims should look elsewhere. Project issues go through GitHub issues; security vulnerabilities use a responsible disclosure process.

Pros and cons

Pros

• Backend flexibility: PKCS#11, Vault Transit and KMIP options let teams delegate cryptographic work to systems they already operate.
• Policy checked per operation: External authorization through Cedar, OPA or another decision point supports teams with established policy infrastructure.
• Free self-hosted core: The core includes hierarchy coordination without a recurring license price.
• Auditable event options: NATS, files and stdout delivery plus hash-chain linking can fit different logging pipelines.

Cons

• Operational burden: Teams must deploy and maintain the service themselves.
• Security configuration matters: REST is plain HTTP and gRPC TLS is opt-in, requiring deliberate HTTPS termination and transport planning.
• Commercial features cost extra: HA clustering, management UI and the AWS and Barbican shims sit outside the open-source core.
• Cloud shim gaps: GCP Cloud KMS and Azure Key Vault shims are not implemented.

Alternatives

Key Management Software is the broader category to compare if KeyRack's self-hosted coordination model is not the right fit.

• Thales CipherTrust Data Security Platform is worth considering for readers seeking a freemium option with a free Community Edition and a free trial across API, Linux, self-hosted and web platforms.
• Kleopatra is a free, open-source certificate manager for readers who need a Linux or Windows certificate tool rather than a self-hosted key coordination layer.
• Oracle Cloud Infrastructure Secret Management is an alternative for readers looking at a cloud secret-management service with a stated limit of 5,000 secrets per tenancy and 30 active versions per secret.
• OpenStack Barbican is a free, self-hosted API option for teams seeking an OpenStack-focused alternative.
• Entrust Certificate Manager is a paid alternative for readers seeking a certificate manager across mobile, API, Linux, self-hosted and web platforms.
• Cryptsoft KMIP Server is a paid API and self-hosted KMIP server SDK offered in C or Java.
• Eviden KMS is a paid option with per-CPU pricing, all connectors included and any number of servers.
• Fornetix Key Orchestration Platform may suit teams looking for VaultCore, with quote-based pricing and a full-featured 30-day trial.

Verdict

Choose KeyRack if you need a self-deployed key coordination layer with external authorization and configurable cryptographic backends. Its strongest case is the free core's mix of hierarchy management, backend choice and per-operation policy checks. Look elsewhere if you need a hosted cloud KMS, default transport security without extra configuration, or implemented GCP Cloud KMS and Azure Key Vault shims.