Stop pasting production credentials into chat.

Store secrets in ohapi. Load them with the CLI. Send a one-time link to a person without an account. The database never stores a secret value in plaintext.

$ ohapi loginAuthorized.

$ ohapi pullWrote 14 secrets from development to .env.localWrote 14 keys to .env.example

$ ohapi run -- npm run dev# no .env file written

ENCRYPTAES-256-GCM before storage
CLIPull or inject secrets
OIDCNo long-lived secret in CI
APPROVALAdmin approval on production

CLI

Sign in from the browser. Load secrets on your machine.

Run ohapi login. The CLI opens a browser. You do not copy a key.
Run ohapi pull. The CLI writes .env.local and .env.example.
Or run ohapi run -- npm run dev. That command puts secrets into the process environment. It does not write secrets to disk.
Read the CLI guide

$ ohapi loginAuthorized.Saved to ~/.ohapi/config.json (readable only by you). $ ohapi run -- npm run dev# secrets are in the process environment, not on disk

Encryption

The database never stores a secret in plaintext.

ohapi encrypts each secret value with AES-256-GCM in the application. Then Postgres stores the ciphertext. Each value records its key version. Old values stay readable when you rotate the key.

Value
in the application
AES-256-GCM
key version v2
Ciphertext
in Postgres

Team controls

Every reveal writes an audit row.

Roles are Admin, Member, and Viewer.
Values stay masked until a person clicks Reveal. The page does not hold the value before that click.
Changes to production can require approval from one or more other admins.
You can export the audit log as a CSV file.

Key	Value	Action
DATABASE_URL	••••••••••••
STRIPE_KEY	••••••••••••

Audit log

No reads yet.

This demo runs in your browser. It does not call ohapi.

CI and API

CI does not store a long-lived secret.

A GitHub Actions job exchanges its OIDC token for an ohapi API key. That key expires after one hour. Machines can use service accounts instead of a person's account. The REST API has a public OpenAPI file.

GitHub OIDC token
One-hour key
Pull secrets

Sync and share

Push secrets to Netlify, Vercel, AWS Secrets Manager, GitHub Actions, or a signed webhook.

Netlify
Vercel
AWS Secrets Manager
GitHub Actions
Signed webhook

A sync deletes only the values that ohapi marked or recorded as its own. To send a secret to a person without an account, create a one-time link. The link stops working after one view.

/share/…

Someone shared a secret with you.

••••••••••••

This demo runs in your browser. It does not call ohapi.

Hosting

Use the managed service, or run your own.

Managed

Any verified Google account can create an account. An organization can add single sign-on with OpenID Connect, for example Okta or Microsoft Entra ID.

Self-host

Run ohapi and Postgres on your own server with Docker Compose.

docker compose up -d --build