Stop sharing API keys in Slack.
Encrypted vault for shared API credentials. Issue scoped tokens to team members, log every access, rotate keys without redeploying. AES-256-GCM at rest, offline-verifiable Pro license.
Running in under 60 seconds.
curl -fsSL https://stockyard.dev/fence/install.sh | sh
FENCE_ADMIN_KEY=secret \
FENCE_ENCRYPTION_KEY=$(openssl rand -hex 32) \
fence
API: http://localhost:8770/api
Resolve: http://localhost:8770/api/resolve/{key_name}
# Create a vault and store a key
curl -s -X POST http://localhost:8770/api/vaults \
-H 'Authorization: Bearer secret' -d '{"name":"production"}'
curl -s -X POST http://localhost:8770/api/vaults/{id}/keys \
-H 'Authorization: Bearer secret' \
-d '{"name":"openai","value":"sk-...","provider":"openai"}'
# Issue a token to a team member
curl -s -X POST http://localhost:8770/api/vaults/{id}/tokens \
-d '{"member_id":"{mid}","name":"alice"}'
# → fence_... (save it — shown once)
# Member resolves the key at runtime
curl http://localhost:8770/api/resolve/openai \
-H 'Authorization: Bearer fence_...'
Fence stores credentials encrypted at rest. Team members resolve them at runtime with scoped tokens. The dashboard shows vault contents (names only — values never shown), members, and every access.
Three things developers use this for.
The moment you store keys in someone else's cloud, you have accepted their terms, their pricing changes, and their uptime. Fence puts that decision back in your hands.
Start Fence with a port and a data directory. It creates its SQLite database on first run. Create keys through the web interface or POST JSON to the API. Filter and search by keyword.
A consultant keeps Fence running on a home server. Client keys stay on local disk, simplifying privacy in every contract.
Free to run. Pro when you need more.
- 10 keys
- 2 members
- 2 projects / vaults
- Key labeling and notes
- AES-256-GCM encrypted local storage
- Basic access log
- Manual key add / remove
- Unlimited keys
- Unlimited members
- Unlimited projects / vaults
- Role-based access (admin / reader)
- Full key usage audit trail
- Expiration reminders
- Tags and search across keys
- Export / import key sets
- Rotation reminders
- Shared vault views across team
When Fence is the right tool.
Fence is for teams sharing API keys through .env files or chat — which is most teams. Free covers 10 keys, 2 members, and 2 vaults. Pro ($4.99/mo) removes those limits and adds RBAC, full audit trail, and key rotation reminders.
When you need the full LLM control plane.
Learn about Stockyard →How Pro gets activated.
When your payment goes through, you'll receive an email at the address you used at checkout. The email contains your license key — a string that starts with stockyard_.
Set it as an environment variable before starting Fence:
FENCE_LICENSE_KEY=stockyard_your_key_here fence License: Pro (your-email@example.com) Dashboard: http://localhost:8770/ui
That's it. Pro features unlock immediately on startup — no restart required after the first run, no account to log into, no phone-home check. The key is verified locally.
Check your spam folder first. If it's not there after 5 minutes, email hello@stockyard.dev with your payment confirmation and we'll send the key manually.
FENCE_ENCRYPTION_KEY. Set this to a 32-byte hex string generated with openssl rand -hex 32.key_id when issuing a token and that token can only resolve that specific key, not the whole vault.Stop sharing API keys in Slack.
Encrypted storage. Instant revocation. Free to start.
Part of Stockyard Complete — all 150 tools for $29/mo