Encrypted at rest · audited · API-first

Secrets for every environment, in one place.

Keep environment variables and API keys per project and per environment. See what's missing where, change anything with a full audit trail, and let servers and CI pull exactly the secrets they need.

DevelopmentStagingProduction
DATABASE_URLpostgres://app@db.internal/shop
STRIPE_SECRET_KEY••••••••••••••••••••
REDIS_URLredis://cache.internal:6379
WORKERS8
SENTRY_DSNmissing — set in Staging

Everything a team needs to stop pasting .env files around

Environments & configs

Development, Staging and Production out of the box. Add your own, and fork configs like prd_eu or dev_local.

Missing-key detection

Every environment shows which keys exist elsewhere but not here — copy one or all of them across in a click.

Rows or .env

Edit key by key with types (url, json, boolean …) or switch to a plain .env editor. Both save atomically.

Audit log & rollback

Every change is recorded with who made it — a person or an API token — and can be undone.

Scoped API tokens

Give CI read access to staging only, or a deploy job write access to one environment. Tokens can expire.

Encrypted at rest

Values are AES-256-GCM encrypted and bound to their project. Tokens are stored as hashes, never in the clear.

Import & export

Bring existing .env, JSON, YAML or CSV files in; export any config in the same formats.

Sign in your way

Passkeys, email codes, passwords and MFA through AuthLock — Crypture never sees a password.

One line in your deploy script

Create a token that may read Production, then pull the config as .env, JSON or YAML. Write access is opt-in per environment, and every call shows up in the audit log under the token's name.

Using an LLM agent? Point it at /docs/llm/api.md.

curl -fsS -H "Authorization: Bearer $CRYPTURE_TOKEN" \
  "https://crypture.app/api/v1/secrets?environment=prd&format=env" > .env

Ready when you are

Create a project and your three environments are there already.

Get started — it’s free