Identity-based delivery
A service authenticates on its own — client credentials or a one-time enrollment token. Trading that token twice means it leaked, so it is not merely refused: it raises an alert.
machine identity · envelope encryption · every read audited
Secrets your services fetch themselves
No copying over SSH, no variables pasted into CI settings, no copy in somebody's password manager. A service authenticates on its own at startup and reads what it needs — and every read stays in the log.
billing-api / production
import { EnvMasterClient } from "@env-master/sdk";
const em = new EnvMasterClient({
baseUrl: process.env.ENVMASTER_URL,
project: "billing-api",
environment: "production",
});
await em.loginMachine({
clientId: process.env.ENVMASTER_CLIENT_ID,
clientSecret: process.env.ENVMASTER_CLIENT_SECRET,
});
const password = await em.get("DB_PASSWORD");production
4 keysDB_PASSWORD••••••••••••PAYMENT_TOKEN••••••••••••LOG_LEVELdebugMACHINE_ONLY_KEYrestrictedVariables are visible at once, secrets only on an explicit, audited request — and restricted entries are never shown to a person at all.
Three steps, and deployment stops carrying secrets
01
Set up an environment
A project, its dev/staging/prod environments and the entries in them — variables in the open, secrets hidden until asked for.
02
Issue the service an identity
A machine identity is bound to one environment and, if you want, to a set of keys. Its secret is shown once — after that only a hash remains.
03
Drop .env from your deploy
The SDK fetches values at startup and keeps them in process memory. Rotation stops being an event: the service reads the current value by itself.
What is inside
We defend the perimeter and say plainly where it ends: at rest there is only ciphertext, but the running server sees values while it handles them. You will not find the words “zero-knowledge” here.
Envelope encryption
Values under an environment data key, the data key under a root key. A machine receives the key wrapped with x25519 for its identity and decrypts client-side.
Rotation without downtime
create → set → test → finish. A new value becomes current only after the test passes; until then it waits under the pending label and survives a crash.
Every read audited
Two streams — changes and reads — hash-chained together. The log holds key names and a value HMAC, never the value itself.
Scoped down to a key set
An identity is limited to a project, an environment and a list of keys: the billing worker gets DB_*, not the whole environment.
Mobile client
The audit feed, alerts and approvals from a phone: production access gets approved where you are, not where your laptop is.
Your first service can fetch its secrets today
Sign up, create a project, add your keys, issue an identity. The free plan is not cut down on security: encryption, rotation and auditing work from the first minute.