> ## Documentation Index
> Fetch the complete documentation index at: https://keyflare.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Open-source secrets manager built entirely on Cloudflare

<Frame>
  <img src="https://mintcdn.com/keyflare/WtTT0Gr-s-WX9P6h/assets/logo-landscape.png?fit=max&auto=format&n=WtTT0Gr-s-WX9P6h&q=85&s=f6b281c7f0f4aade0a314ec29a1c60a4" alt="Logo Landscape" width="1536" height="663" data-path="assets/logo-landscape.png" />
</Frame>

# Keyflare

**Free, open-source secrets manager built entirely on Cloudflare.**

Single Worker + single D1 database + single master key. Zero trust storage. Self-hosted in one click.

Think of it as a self-hosted [Doppler](https://www.doppler.com/) or [Infisical](https://infisical.com/) — but runs entirely on Cloudflare with zero infrastructure to manage.

Get started now:

```shellscript theme={null}
npm install -g @keyflare/cli
```

## Why Keyflare?

<CardGroup cols={2}>
  <Card icon="fire" title="Free + Open Source">
    MIT licensed. No restrictions, no lock-in. Own your secrets infrastructure completely.
  </Card>

  <Card icon="server" title="Self-Hosted">
    Deploy to your own Cloudflare account in seconds. All you need is a **free Cloudflare account**.
  </Card>

  <Card icon="cube" title="Simple Architecture + One-Click install">
    One Worker, one D1 database, one master key. No containers, no VMs, no Kubernetes.
  </Card>

  <Card icon="lock" title="Zero Trust Storage">
    Secret values and keys are AES-256-GCM encrypted at rest. Even with database access, data remains protected.
  </Card>
</CardGroup>

## Core Concepts

Keyflare uses a simple mental model: **Projects → Environments → Secrets**.

```text theme={null}
Project (my-api)
├── Environment (development)
│   ├── DATABASE_URL=postgres://...
│   └── API_KEY=sk_dev_...
├── Environment (staging)
│   ├── DATABASE_URL=postgres://...
│   └── API_KEY=sk_staging_...
└── Environment (production)
    ├── DATABASE_URL=postgres://...
    └── API_KEY=sk_live_...
```

### Projects

A project is a namespace for secrets (e.g., `my-api`, `frontend-app`). Each project can have multiple environments.

### Environments

Each project has environments (e.g., `production`, `staging`, `development`). New projects get two default environments (**dev** and **prod**) unless created with the `--environmentless` flag. Project and environment names are case-insensitive.

### Secrets

Key-value pairs stored per environment. Both key names and values are encrypted in D1 using AES-256-GCM.

## API Keys

Keyflare uses API keys for authentication. There are two types:

|             | User Key                                  | System Key                                  |
| ----------- | ----------------------------------------- | ------------------------------------------- |
| **Prefix**  | `kfl_user_*`                              | `kfl_sys_*`                                 |
| **Access**  | Full admin (all projects, keys, settings) | Scoped to specific project:environment      |
| **Use for** | Developers, admins, backup keys           | CI/CD, deployment scripts, runtime services |

**User keys** have full unrestricted access to everything — projects, environments, secrets, and API key management.

**System keys** are scoped to specific `(project, environment)` pairs with either `read` or `readwrite` permission. They cannot create projects, environments, or other keys.

## How It Works

```mermaid theme={null}
graph TB
    CLI[CLI - kfl] -->|HTTPS| Worker[Cloudflare Worker]
    Worker -->|Encrypted queries| D1[(D1 Database)]
    Worker -->|In-memory| MASTER_KEY[MASTER_KEY Secret]
    
    subgraph "Cloudflare Edge"
        Worker
        D1
        MASTER_KEY
    end
```

1. **CLI** (`kfl`) communicates with the Worker API over HTTPS
2. **Worker** validates API keys, enforces scopes, encrypts/decrypts secrets
3. **D1 Database** stores encrypted secret data and hashed API keys
4. **MASTER\_KEY** (Worker secret) is used for all encryption/decryption operations

<h2 noAnchor>Next Steps</h2>

<CardGroup cols={2}>
  <Card href="/getting-started/quickstart" title="Quick Start">
    Deploy Keyflare to your Cloudflare account in minutes.
  </Card>

  <Card href="/architecture/overview" title="Architecture">
    Understand how Keyflare works under the hood.
  </Card>
</CardGroup>