Pricing
Pick the plan that fits your team. Every plan encrypts values in the same way. A plan never changes how ohapi stores a value.
Prices are in US dollars and do not include tax.
Service accounts are free
A service account is a machine identity, for example a CI bot. Service accounts do not count as members. The operator does not bill them.
Free
$0
- Members: 3
- Projects: 3
- Secrets per project: Unlimited
- Support: Documentation and OHSupport chat
Team
$12 per member per month
$10 per member per month when you pay once a year.
- Members: Unlimited
- Projects: Unlimited
- Secrets per project: Unlimited
- Support: Email, answer on the next business day
Enterprise
Contact us
- Members: Unlimited
- Projects: Unlimited
- Secrets per project: Unlimited
- Support: Terms that we agree with you, and onboarding help
The member and project limits are plan limits. The operator enforces them. The software does not enforce them.
Features
Every plan includes every feature. The plans differ only by limits and support.
| Feature | Free | Team | Enterprise |
|---|---|---|---|
| AES-256-GCM encryption before the database, key rotation | Included | Included | Included |
| Projects, environments, secrets, versions, restore | Included | Included | Included |
| CLI: login (browser or device), pull, run | Included | Included | Included |
| MCP server for agents | Included | Included | Included |
| REST API with a public OpenAPI file | Included | Included | Included |
| GitHub Actions OIDC exchange and the GitHub Action | Included | Included | Included |
| Service accounts | Included | Included | Included |
| Scoped keys for CI trusts and service accounts | Included | Included | Included |
| Dual control on production (1 to 5 approvals) | Included | Included | Included |
| Audit log, 90 days, CSV export | Included | Included | Included |
| Email, Slack-compatible and signed-webhook notifications | Included | Included | Included |
| Sync to Netlify, Vercel, AWS Secrets Manager, GitHub Actions and a signed webhook | Included | Included | Included |
| One-time share links | Included | Included | Included |
| Organization SSO (OIDC) with verified domains and enforcement | Included | Included | Included |
| Terraform provider | Included | Included | Included |
| External Secrets Operator manifests (generic webhook) | Included | Included | Included |
| Self-host with Docker Compose | Included | Included | Included |
Self-host
You can run ohapi yourself with Docker Compose. The code and the database schema are the same. The repository is private. To ask about self-host, contact us.
Questions
What counts as a member?
A member is a person who belongs to an organization. A service account is not a member.
What counts as a project?
A project holds environments, and each environment holds secrets. Each project belongs to one organization.
What is the rate limit?
The API accepts 600 requests each minute for each API key.
How long does ohapi keep the audit log?
ohapi keeps audit rows for 90 days. You can export the log of a project as a CSV file.
How do I cancel?
Send an email to hello@ohapi.dev.