Stop sharing API keys in Slack.
Encrypted vault for shared API credentials. Issue scoped tokens to team members, log every access, rotate keys without redeploying. AES-256-GCM at rest, offline-verifiable Pro license.
Running in under 60 seconds.
curl -fsSL https://stockyard.dev/fence/install.sh | sh
FENCE_ADMIN_KEY=secret \
FENCE_ENCRYPTION_KEY=$(openssl rand -hex 32) \
fence
API: http://localhost:8770/api
Resolve: http://localhost:8770/api/resolve/{key_name}
# Create a vault and store a key
curl -s -X POST http://localhost:8770/api/vaults \
-H 'Authorization: Bearer secret' -d '{"name":"production"}'
curl -s -X POST http://localhost:8770/api/vaults/{id}/keys \
-H 'Authorization: Bearer secret' \
-d '{"name":"openai","value":"sk-...","provider":"openai"}'
# Issue a token to a team member
curl -s -X POST http://localhost:8770/api/vaults/{id}/tokens \
-d '{"member_id":"{mid}","name":"alice"}'
# → fence_... (save it — shown once)
# Member resolves the key at runtime
curl http://localhost:8770/api/resolve/openai \
-H 'Authorization: Bearer fence_...'
Fence stores credentials encrypted at rest. Team members resolve them at runtime with scoped tokens. The dashboard shows vault contents (names only — values never shown), members, and every access.
Three things developers use this for.
Free to run. Pro when you need more.
- 5 keys
- 2 members
- 2 projects / vaults
- Key labeling and notes
- AES-256-GCM encrypted local storage
- Basic access log
- Manual key add / remove
- Unlimited keys
- Unlimited members
- Unlimited projects / vaults
- Role-based access (admin / reader)
- Full key usage audit trail
- Expiration reminders
- Tags and search across keys
- Export / import key sets
- Rotation reminders
- Shared vault views across team
When Fence is the right tool.
Fence is for teams sharing API keys through .env files or chat — which is most teams. Free covers 5 keys, 2 members, and 1 vault. Pro ($7.99/mo) removes those limits and adds RBAC, full audit trail, and key rotation reminders.
When you need the full LLM control plane.
Learn about Stockyard →How Pro gets activated.
When your payment goes through, you'll receive an email at the address you used at checkout. The email contains your license key — a string that starts with SY-.
Set it as an environment variable before starting Fence:
STOCKYARD_LICENSE_KEY=SY-your_key_here fence License: Pro (your-email@example.com) Dashboard: http://localhost:8770/ui
That's it. Pro features unlock immediately on startup — no restart required after the first run, no account to log into, no phone-home check. The key is verified locally.
Check your spam folder first. If it's not there after 5 minutes, email hello@stockyard.dev with your payment confirmation and we'll send the key manually.
FENCE_ENCRYPTION_KEY. Set this to a 32-byte hex string generated with openssl rand -hex 32.key_id when issuing a token and that token can only resolve that specific key, not the whole vault.Stop sharing API keys in Slack.
Encrypted storage. Instant revocation. 14 days free.
Part of Stockyard All Tools — all 164+ tools — 14-day free trial, then $7.99/mo per bundle