SikkerKey

SikkerKey is a cloud-based vault for application and infrastructure credentials, aimed at engineers and DevOps teams that need machine-oriented access control. It is strongest when deployments span many runtime environments and secret formats; smaller teams should weigh its machine-based pricing limits before committing.

Overview

Each machine proves its identity by signing requests with an Ed25519 private key kept on that host. This avoids placing a reusable machine password in the vault and gives infrastructure automation a distinct authentication pattern. Secret quantities, project counts, read volume and rotation frequency are unlimited on every plan, so growth in those areas does not trigger a quota wall.

Protection uses envelope encryption in three layers: every secret has an AES-256-GCM data key, those keys are covered by project master keys, and a separate root key sits above them. SikkerKey says its vault, stored secrets and audit trail remain in the European Union and are operated from Denmark. It processes data in the EEA and says GDPR safeguards apply to processing and transfers, which will matter to organizations with European data-residency requirements.

Key features

The service handles standard and structured values alongside managed, leased, certificate, canary and TTL secrets. That range suits teams that need short-lived credentials, certificate material or deliberately detectable decoys rather than only static environment variables. Rotation, dynamic secrets, CI/CD injection, Kubernetes support and audit logs are included capabilities.

Integration paths include the packaged CLI, official SDKs and signed HTTP requests. SDKs are provided for Go, Python, Node.js, .NET, Kotlin and PHP. The integration model reaches CI/CD pipelines, containers, application platforms, serverless functions, conventional servers and on-premise systems, making it practical for mixed deployment estates. The CLI supports Linux x64 and ARM64, macOS Intel and Apple Silicon, and Windows x64.

Its MCP server gives AI agents their own identity class and prevents them from retrieving plaintext secret values. That is a meaningful boundary for teams introducing AI into operational workflows, although it does not replace broader machine and project governance. Direct in-dashboard support is included on every plan.

Pricing

Developer is free forever and includes 10 machines, one month of audit retention and 20 webhook deliveries per day. Extra machines cost $5 per machine per month. It is suitable for an individual developer or a small proof of concept, but the short audit window and low webhook allowance can constrain production automation.

Teams costs $29 per month, billed monthly. It includes 25 machines, 12 months of audit retention, 1,000 webhook deliveries per day and five private-infrastructure tunnels. Additional machines are $4 each per month. This is the sensible starting point for a growing engineering group that needs longer audit history and private connectivity without the top-tier commitment.

Teams Pro costs $79 per month, billed monthly. The allowance rises to 75 machines, 24 months of audit retention, 5,000 webhook deliveries per day and 10 private-infrastructure tunnels; extra machines cost $3 each per month. It fits larger or busier infrastructure estates where machine count, event volume and retention are operational requirements. There is no free trial, so evaluation must begin on the free Developer plan.

Platforms

SikkerKey is delivered as a cloud service with API, web, Linux, macOS and Windows access. Its CLI packaging covers both common desktop architectures and Linux ARM64, while SDK and signed-HTTP options support server-side and on-premise deployments.

Who it's for

Choose SikkerKey if you are a software engineer, DevOps team or organization managing application secrets across CI/CD, Kubernetes, servers and private infrastructure. It is particularly well matched to teams that value machine-authenticated requests, European hosting and varied secret lifecycles. It is less compelling for a tiny project that needs only a handful of secrets and wants a longer audit history without paying for a team plan.

Pros and cons

• Pro: Unlimited secrets, projects, reads and rotation frequency keep core usage from being metered.
• Pro: Seven secret categories, dynamic credentials and rotation cover more than basic configuration storage.
• Pro: Ed25519 request signing gives machines a dedicated authentication mechanism.
• Pro: EU operation from Denmark and stated EEA GDPR safeguards support regulated European deployments.
• Con: The free plan retains audit data for only one month and permits 20 webhook deliveries daily.
• Con: Machine allowances are finite on every tier, with per-machine charges once the included quota is exceeded.
• Con: There is no free trial, so teams must assess paid features through the capped free plan.

Alternatives

For a free forever developer plan with up to two members, three projects and unlimited secrets, consider Envshed. Keyway is the better fit when self-hosting and collaborator-friendly plans starting at 9 EUR per month matter. Pick Kubermatic Kubernetes Platform when an Apache 2.0 open-source Kubernetes platform is the priority.

Phase suits teams wanting a free tier with up to five users or service accounts, three apps and three environments. secr is a lower-cost option with a free three-project tier and a 6 USD monthly Pro plan. Choose Secrets Manager for an open-source, self-hosted setup aimed at a single developer.

dotenvx is the alternative when a free, open-source CLI and SDK workflow is preferable. Infisical is worth choosing for a free tier with five identities, unlimited projects and more than 100 integrations. Browse the full Secrets Management Tools list for additional options.

Verdict

SikkerKey is a strong choice for engineering and DevOps teams that need machine-signed access, broad secret types, infrastructure integrations and EU-operated storage. Its main reason to look elsewhere is the plan structure: audit retention, webhooks, tunnels and machine counts are tightly tiered, and there is no trial beyond the limited free plan.