My BeastDiscounts and news by email. Unsubscribe in one click.
Each project keeps its variables per environment: development, staging and production to start. Values are encrypted before they are stored, every change is kept, and a server pulls its environment with a read-only token, through the mybeast-secrets CLI or the API.
For developers, operations and security.
You sign up and pay for Secrets separately from hosting.
Prices are without VAT: VAT is added at checkout, where it applies. Plans renew each month or year until you cancel. Ask within 30 days of your first payment, or 14 days of a renewal, and you get it back in full. Sold by our reseller Paddle, which handles payment, VAT and invoices. Terms · Refunds
Pick Secrets and a plan, name your project and pay. It starts with development, staging and production.
Type them in, or paste the .env you have and check what it adds before you save.
In the project's settings, make a read-only token for one environment. It is shown once.
Install the CLI and write a .env with mybeast-secrets pull, or start your app with mybeast-secrets run, which writes nothing.
| Starter€9 a month€90 a year | Team€29 a month€290 a year | Business€49 a month€490 a year | |
|---|---|---|---|
| Environments | 3 environments | 10 environments | 20 environments |
| Variables per environment | 50 variables | 200 variables | 500 variables |
A new environment, or a variable past the plan's limit in one, is refused, and what you have keeps working.
mybeast-secretsEach value is encrypted with AES-256-GCM under its project's key, itself encrypted under a master key used for Secrets alone. Secret values stay hidden on the page; showing one or exporting is recorded. Tokens are read-only, for one environment, and stored only as a hash. Every read is recorded.
A new environment, or a new variable in a full environment, is refused until you remove one. An import that would pass the limit is refused whole. What you have keeps working, reads are not counted, and a smaller plan takes nothing away.
There is no free plan and no test mode. Each project has development and staging environments beside production, so you can try it there first.
Any. The mybeast-secrets CLI needs only bash and curl: it writes a .env file, or runs your command with the variables in its environment. Anything else can read the API with a service token, as JSON or as a .env file.
On our servers in Germany. Variables are kept until you remove them. The history of changes keeps earlier values, encrypted, with no time limit. The record of each read, each value shown and each export is kept for 24 months.
Each value is encrypted with AES-256-GCM under its project's key, which is itself encrypted under a master key used for Secrets alone. A Secret value is opened only for a token of its environment, or for someone allowed to show it, and both are recorded.
Yes. A service token reads its own environment and nothing else, and cannot change anything. It is stored only as a hash, shows when it was last used, and stops working the moment you revoke it.
A pull then writes nothing, so the .env you have stays as it was. mybeast-secrets run does not start your command without its variables.