secr

secr is a cloud secrets manager for development teams that need controls for both human users and AI agents. It is best suited to teams managing credentials across development and production workflows. Its CLI-based delivery and agent controls are compelling; the free plan’s low project and audit-log caps make it a starting point, not a broad team tier.

Overview

secr injects secrets into a process through its CLI rather than requiring them to be stored in .env files. Teams can keep development, staging and production secrets separate, compare values and promote them between environments. That workflow can reduce credential exposure in project files and suits teams with distinct deployment stages. The cloud-only deployment model is a drawback for organizations that require self-hosting.

Key features

Role-based access control includes environment-level permissions, so teams can restrict access to production credentials separately from development secrets. A scanner detects more than 20 credential patterns and can install a pre-commit hook to block leaks before they reach git. Together, these features address both who can retrieve secrets and accidental commits.

AI agent identities can use scoped credentials, secret allowlists and conditional access policies. That makes secr relevant to teams connecting agents to services without giving them broad access to a project’s secrets. Integrations include OpenClaw, MCP servers, Slack and Telegram approvals, LangChain, CrewAI, VS Code, GitHub Actions, Vercel, Netlify, Terraform, and Node.js, Python and Go SDKs. The integrations page also lists imports from Render, Heroku, Supabase, Railway, AWS, Cloudflare, DigitalOcean, Fly.io and GitHub.

Each project uses an AES-256-GCM encryption key wrapped by an external KMS, with AWS KMS, GCP Cloud KMS and Azure Key Vault named as options. Mutations to secrets, projects and membership enter an immutable audit log, but the retention period varies by plan. The security page describes SOC 2 control mapping as a self-assessment; formal SOC 2 Type II certification is on its roadmap, so organizations requiring that certification should not treat the mapping as equivalent.

Pricing

secr is freemium, with a 14-day free trial on Pro and Team. Paid per-user pricing makes the number of seats an important part of the cost decision; no seat count is stated for the free plan.

• Free — free, billed $0 forever: 3 projects, 100 secrets, 1 AI agent and a 7-day audit log. This is aimed at solo developers and small side projects. The caps can be restrictive once several projects or agents need coverage, and short retention limits how far back a team can review changes.
• Pro — $6 a month, billed $6/user/mo: unlimited projects and secrets, 5 custom environments and a 30-day audit log, with a 14-day free trial. It is described for growing teams shipping to production; the expanded capacity and longer retention are meaningful upgrades, though the five-environment cap remains a consideration for teams with more complex setups.
• Team — $14 a month, billed $14/user/mo: unlimited projects and secrets, 20 custom environments and a 90-day audit log, plus priority support and a 14-day free trial. It suits teams that need more environments, longer audit history or priority support. The higher per-user price is harder to justify if those additions are not needed.
• Enterprise — custom pricing: 365-day audit retention, dedicated infrastructure, SLA and onboarding. This is the tier to consider when long audit retention, dedicated infrastructure or service commitments matter; its custom price requires a separate cost evaluation.

Platforms

secr supports API, browser extension, Linux, macOS, web and Windows. Its cloud deployment and CI/CD injection support suit teams integrating secrets into build and deployment workflows, while the lack of a self-hosted option may rule it out for teams that need to operate the service themselves.

Who it's for

Solo developers and small side projects can start on Free, provided 3 projects, 100 secrets, 1 AI agent and 7-day audit retention are enough. Pro is the more natural fit for growing production teams that need unlimited projects and secrets, while Team adds room for more custom environments, longer logs and priority support. Organizations requiring formal SOC 2 Type II certification or self-hosting should look elsewhere.

Pros and cons

• Pro: CLI injection keeps secrets out of .env files, and separate environments with promotion support a staged release workflow.
• Pro: Environment-level permissions, pre-commit scanning and scoped AI credentials address distinct access and leakage risks.
• Pro: External KMS wrapping and immutable audit logs add encryption and change-tracking controls, with retention extending to 365 days on Enterprise.
• Con: Free is capped at 3 projects, 100 secrets, 1 AI agent and 7-day audit retention, limiting its usefulness as a team’s needs grow.
• Con: Pro and Team are priced per user, and custom environments are capped at 5 and 20 respectively.
• Con: The SOC 2 Type II certification is on the roadmap rather than achieved, and deployment is cloud-only.

Alternatives

Compare secrets management tools if you want to consider the wider category. Choose Envshed if a free plan with unlimited secrets matters more than secr’s stated AI-agent allowance: its Developer plan includes up to 2 members and 3 projects. Keyway may suit teams prioritizing unlimited environments and collaborators; its Pro plan is 9€/month, while Team is 19 per month.

Kubermatic Kubernetes Platform is a Kubernetes-focused alternative with a free, open-source Community Edition under Apache License 2.0. Consider Phase if its free plan’s stated allowance of up to 5 users or service accounts, 3 apps and 3 environments better fits your setup. Secrets Manager is an open-source self-hosted option for a single developer, but it requires Docker Compose and Node 20+ for its CLI.

SikkerKey is another freemium option. dotenvx is described by its maker as free and open source, with a CLI, SDKs and secret encryption. Infisical offers a free Secrets Management plan with 5 identities, unlimited projects and 100+ integrations.

Verdict

Choose secr if your team wants CLI-delivered secrets, environment-specific permissions and a defined set of controls for AI agents in one cloud service. Its strongest case is the combination of application secrets workflows with agent-scoped access. Look elsewhere if you need self-hosting, formal SOC 2 Type II certification now, or if the per-user paid tiers and free-plan caps do not fit your team.