Get started with Kryptic
Install the daemon, add a SDK, and run your app - secrets inject automatically. For the complete reference, visit the full documentation.
Full documentation at docs.kryptic.dev ->Four steps to zero-friction secrets
- 01
Install the daemon
Download the installer for Windows (.exe), macOS (.dmg), or Linux (.deb). Sign in once with Google or Microsoft.
- 02
Add kryptic.json
Commit a kryptic.json with your project ID to the repo root. No secrets - safe for version control.
- 03
Install the SDK
Add the language SDK as a dev dependency and call the inject method at application startup.
- 04
Run your app
dotnet run, npm run dev, python manage.py runserver - secrets inject automatically over a local socket.
Safe to commit - contains only the project ID, no secrets or tokens.
{
"$schema": "https://kryptic.dev/schema/kryptic.json",
"projectId": "proj_a1b2c3d4e5f6",
"defaultEnvironment": "development"
}Language SDKs
Each SDK detects the daemon passively and injects secrets idiomatically for its runtime.
dotnet add package krypticdevusing KrypticDev;
var builder = WebApplication.CreateBuilder(args);
// Add this single line - that is the entire integration
builder.Configuration.AddKryptic();
var app = builder.Build();
// Secrets available via IConfiguration, IOptions<T>, etc.
var dbUrl = builder.Configuration["DATABASE_URL"];Manage the background client
kryptic statusShow daemon status and authenticated userkryptic loginRe-authenticate (opens browser)kryptic logoutRevoke local token and stop daemonkryptic whoamiPrint current authenticated user and orgkryptic secrets listList secrets for the current projectkryptic secrets get KEYPrint a specific secret valuekryptic scanScan the current directory for leaked secretsSDK configuration overrides
Environment variables take precedence over kryptic.json settings.
| Variable | Default | Description |
|---|---|---|
| KRYPTIC_ENV | development | Override the environment to fetch secrets from |
| KRYPTIC_PROJECT_ID | (from kryptic.json) | Override the project ID |
| KRYPTIC_SOCKET_PATH | (OS default) | Override the daemon socket path |
| KRYPTIC_TIMEOUT_MS | 2000 | Daemon connection timeout in milliseconds |
| KRYPTIC_DISABLED | false | Set to 'true' to disable Kryptic entirely |
| KRYPTIC_SILENT | false | Suppress all Kryptic console output |
GitHub Actions integration
Machine identities authenticate CI runners with scoped, short-lived access tokens.
- name: Inject Kryptic secrets
uses: kryptic/action@v1
with:
client-id: ${{ secrets.KRYPTIC_CLIENT_ID }}
client-secret: ${{ secrets.KRYPTIC_CLIENT_SECRET }}
project-id: proj_a1b2c3
environment: staging