Rule-based resolution
Conditional rules evaluated by priority. Match on environment, application, region, IP, or any header. Default value always exists as fallback.
Config delivery, encrypted and rule-based
Configuration that resolves itself.
Store a config key once, attach rules that say who gets what value, and let every application fetch a fully-resolved JSON document over a single HTTP call. Secret values stay encrypted, even from us.
- No credit card
- ETag caching, no redeploys
- Zero-knowledge encryption
- 6 SDKs
How it works
Config without the redeploy loop.
Store a key once, attach conditional rules, and let every application fetch its resolved configuration over a single HTTP call.
- 01
Define keys and rules
Create configuration keys in the dashboard. Set a default value and add conditional rules matched by environment, application, region, IP, or any header. Rules are evaluated by priority; first match wins.
- 02
Get an endpoint token
Each endpoint gets an opaque bearer token. Put it in your application config and make a plain HTTP GET; no client library required, the response is JSON.
- 03
Fetch and resolve
Your application sends a GET request with context headers. KeySentry evaluates the rules and returns the fully-resolved configuration. ETag-based caching means zero transfer when nothing changed.
What's under the hood
Built for secrets, not just strings.
Encryption, caching, rule evaluation, and access control are all handled for you.
Zero-knowledge encryption
Values marked as secrets are encrypted before they leave the server. In ZK mode, the customer holds the private key. The server never sees plaintext.
ETag caching
Responses carry an ETag. SDKs send If-None-Match on subsequent loads. A 304 means zero transfer. Config changes propagate without redeploying consumers.
Envelope encryption
Master key encrypts per-value data keys (DEK). Master key rotation re-encrypts DEKs without touching every value. AES-256-GCM for data at rest and in transit.
Multi-language SDKs
.NET, Node.js, Next.js, PHP, Laravel. Each SDK speaks the same protocol and headers, so you are not locked into one ecosystem.
Audit trail
Every rule evaluation, key change, token rotation, and encryption event writes an audit log entry. Logs contain metadata only, no secret values.
SDKs
One protocol, six languages.
All SDKs share the same protocol: a GET to the config endpoint with standard headers and ETag caching.
.NET
KeySentry, KeySentry.Extensions.Configuration, KeySentry.AspNetCore. Drop into IConfiguration or use the client directly.
Node.js
@skybin-tech/keysentry-node. Fetch config with context, ETag caching, and zero-knowledge decryption.
Next.js
@skybin-tech/keysentry-nextjs. Server-only helper for App Router and Server Components.
PHP
keysentry/sdk. Plain PHP client that works with any framework or script.
Laravel
keysentry/laravel. Service provider that merges remote values into Laravel config at boot.
Pricing
Pay for the configs you manage.
Plans reset monthly. Cancel any time; there is no annual lock-in.
Free
$0/ month
1 project, 5 endpoints, 100 keys.
- Rule-based resolution
- ETag caching
- 1,000 config fetches/month
- Community support
Most popular
Developer
$19/ month
5 projects, 25 endpoints, 500 keys.
- Zero-knowledge encryption
- Envelope encryption
- Audit logs (7 days)
- 5,000 fetches/month
- All SDKs
Team
$49/ month
20 projects, 100 endpoints, 2,000 keys.
- Everything in Developer
- Audit logs (90 days)
- 25,000 fetches/month
- Team members & invites
- Priority support
Keep secrets in one place.
One endpoint, conditional rules, encrypted values. Free to start, no card required.
Create your account