ValtHub keeps your team's secrets encrypted, scoped per project, and in sync across environments — so nobody's DMing production keys again.
Five things ValtHub does today — each screen is the real UI.
$ curl "https://valthub.pages.dev/api/v1/config?project=my-api&flavor=prod" \ -H "Authorization: Bearer $VALTHUB_KEY" 200 OK 48ms · etag "v42" { "project": "my-api", "flavor": "prod", "version": "v42", "values": { "DATABASE_URL": "postgres://••••", "STRIPE_SECRET": "sk_live_••••", … 24 more keys } }
Your secrets, organized — Keys masked with a last-4 hint, grouped by prefix, split by environment.
Compare & sync environments — Diff two environments side by side and copy the keys that drift — with a confirm on production.
Invite to one project, not the vault — Add editors and viewers to a single project; only the invited email can accept.
Every change on the record — Who touched what, when, in which environment.
Pull config in CI — Fetch a flat key–value map at runtime with a scoped, read-only API key.
The everyday habits that put your keys one screenshot away from trouble.
Keys live in Slack threads and screenshots. Anyone scrolling up has them.
A teammate needs one production value, so you hand over the whole file.
Dev, staging, and prod quietly fall out of sync until a deploy breaks.
Every feature here works today — nothing on this page is a mockup of a plan.
Invite someone to a single project as editor or viewer — or to the whole workspace. Their access stops exactly where you set it, and only the invited email can accept.
Diff two environments side by side, spot drift, and copy the keys that are missing or different. Copying into a protected environment asks you to type its name first.
Mark prod as protected and every sync into it needs a typed confirmation. Every reveal, edit, and copy is written to the activity log.
Values are encrypted with AES-256-GCM before they're stored and stay masked in the UI until you reveal them. Sign in with GitHub, Google, or email.
Generate scoped, read-only keys per project and environment, then fetch a flat key–value map over one REST call with ETag caching.
Straight talk, because overclaiming on a secrets manager is worse than saying nothing.
Values are encrypted with AES-256-GCM; they're never stored in plaintext.
Admin, editor, and viewer roles, with invitations scoped per project.
Every reveal, change, and config fetch is recorded and exportable.
An invite can only be accepted by the exact address it was sent to.
No buzzwords: we don't claim SOC 2, zero-knowledge, or bank-grade anything. It's server-side encryption with real access controls and an audit trail.
Four steps, no setup to install.
Use GitHub or Google — or email and password.
A workspace holds your team; a project keeps one app's secrets isolated.
Set up development, staging, and production, and add keys to each.
Add editors and viewers to just the projects they need.
The numbers below are what's enforced today — not a teaser.
For individuals and small teams.
For growing teams that need more room and controls.
Pro is planned — the column shows what's coming. Free limits are what's enforced today.
Sign in with GitHub or Google and set up your first project in a couple of minutes.
Start free