cli

Keyway CLI

Stop sharing .env files on Slack. GitHub access = secret access.

The Problem

You're still doing this:

• Pasting secrets in Slack DMs
• Emailing .env files to new devs
• Rotating every secret when someone leaves
• Manually copying vars to Vercel/Railway/Netlify

The Solution

keyway pull

That's it. If you have access to the repo, you have access to the secrets. No invites, no training, no friction.

Install

Homebrew (macOS & Linux)

brew install keywaysh/tap/keyway

Install Script

curl -fsSL https://get.keyway.sh | sh

npx (no install)

npx @keywaysh/cli init

Direct download

Grab the binary for your platform from Releases.

Quick Start

keyway init

This will:

1. Authenticate with GitHub
2. Create an encrypted vault for your repo
3. Push your local .env to the vault

New teammate joins? They run keyway pull. Done in 30 seconds.

How It Works

keyway init          # First time: create vault, push secrets
keyway push          # Update remote secrets
keyway pull          # Get latest secrets
keyway sync vercel   # Deploy to Vercel, Railway, Netlify

Zero-Trust Mode

Never write secrets to disk. Inject them directly into your process:

keyway run -- npm start
keyway run --env production -- ./my-app

Secrets exist only in memory. When the process exits, they're gone.

Security

Your secrets are protected by:

We can't read your secrets. Even if our database leaks, attackers get encrypted blobs.

Read our security whitepaper →

Commands

Environment Variables

Why Keyway?

• 30 seconds to onboard a new developer
• 0 secrets to rotate when someone leaves (just revoke GitHub access)
• 1 command to deploy secrets to production
• GitHub-native — no new accounts, no new permissions to manage

CI/CD

Use an API key for automation:

# Generate an API key (Dashboard > Settings > API Keys)
# Use scope "read:secrets" for CI — least privilege principle

# GitHub Actions example
env:
  KEYWAY_TOKEN: ${{ secrets.KEYWAY_TOKEN }}
run: keyway pull --env production

Or use the GitHub Action:

- uses: keywaysh/keyway-action@v1
  with:
    token: ${{ secrets.KEYWAY_TOKEN }}
    environment: production

Development

# Prerequisites: Go 1.22+

make build          # Build → ./bin/keyway
make test           # Run tests
make lint           # Run golangci-lint
make install        # Install to /usr/local/bin/keyway

Releases are automated via GoReleaser on tag push.

Links

• Documentation
• Dashboard
• Security
• Status

License

MIT — see LICENSE