Pricing

KeyValet is free and open source. Team plans — shared credentials, org policy, audit export, CI identity — are planned, not available yet.

Free

$0

Open source (Apache-2.0), forever. Everything the product does today:

  • Local vault protected by Secure Enclave + device binding
  • All credential kinds: API keys, OAuth 2.0, Google service accounts, GitHub Apps, JWT, TOTP, AWS STS
  • ~50 service templates + generic bearer/header/query/basic
  • Proxied calls and the loopback SDK gateway
  • Touch ID approval modes: per-use, per-credential, per-session, remember
  • Hooks for Claude Code, Codex, Cursor, Grok Build and Devin CLI
  • keyvalet scan and the local, root-only audit log

Planned for Free:

  • Policy engine (risk tiers, policy.yaml)
  • Linux helper
  • Self-hosted relay
  • iPhone approvals

Install on macOS

Planned — not available yet

Team

$15 per seat / month · $12 billed annually

Machine identities unlimited (fair use).

  • Shared credentials wrapped per member device
  • Org policy as code — it can only tighten members’ local policy
  • Audit export (JSONL / OTLP)
  • CI identity: GitHub OIDC → short-lived capability token; no static secrets in repo settings
  • Hosted relay without quotas
  • Encrypted cross-device sync
  • Member management

14-day trial, no credit card, when it ships.

Get notified

Planned — not available yet

Team + phone approvals

$18 per seat / month · $15 billed annually

Everything in Team, plus:

  • Approval routing to an owner’s phone
  • N-of-M approvals for sensitive credentials
  • Phone approvals for Linux/CI
  • OIDC SSO (Okta, Entra, Google)
  • 90-day encrypted audit retention

Get notified

FAQ

Is Free really free?

Yes — no time limit, no watermark, no security downgrade. An upgrade prompt may appear once, at the moment you hit a Team-only need, and never again.

Do you ever see my secrets?

No. Everything is local: secrets live in a root-only vault on your Mac, protected by Secure Enclave and device binding. Team plans sync only ciphertext wrapped to your devices.

Why does Team cost money?

Shared keys, CI identity, policy distribution and audit export need a relay — and people to run it.

Can I self-host the relay?

Planned, yes — and open source.

What about Enterprise?

Later: self-hosted, SSO/SCIM, isolated CI execution. Not before 2027.