Comparison
KeyVault Edge vs a secrets manager (Doppler, Infisical, Vault)
Secrets managers store your secrets and deliver them to the processes that need them, typically as environment variables. They don't sit in the request path, so they can't help once a key has to be used from code that ships to users.
Pick a secrets manager if
- You need one place for all of an app's secrets (database URLs, signing keys, provider keys) across dev, staging and production.
- Your secrets are only used by servers, CI jobs and containers you control.
- You need team access control over who can read which secret.
Pick KeyVault Edge if
- A provider key has to be used from browser or mobile code.
- You want each client to hold a token with its own allowed hosts, endpoints, rate limits and cost cap instead of the key.
- You want blocked-attempt alerts and one-click revoke per client.
Side by side
| KeyVault Edge | a secrets manager | |
|---|---|---|
| Stores secrets encrypted | Provider API keys only | Any secret |
| How the secret reaches your app | It doesn't: the edge adds it to each allowed request | Injected into your process, e.g. doppler run / infisical run |
| Safe to use from client-side code | Yes, via a scoped token | No: anything shipped to a client is readable |
| Per-request limits (hosts, endpoints, rate, cost) | ||
| Rotation | Rotate the provider key without redeploying (v2 tokens) | New value on next start; Infisical's run --watch restarts on change |
| Manages non-API-key config and secrets | ||
| Price | $9/month, or $90 once for 12 months | Varies by product; see each vendor's pricing |
Using both
Keep your server secrets in the manager. For the one key your frontend needs, register it with KeyVault Edge and ship the token instead. When you rotate at the provider, update the key in KeyVault Edge and your v2 tokens keep working.
We wrote more about the gap between storing a secret and protecting it at request time in Why secret managers don't solve the API key problem (keyvaultedge.com/resources/secret-managers-gap).
See it work before you decide
The free sandbox adds a fake key to a new account and sends three real requests through the proxy: one allowed, one from a foreign site, one to a blocked endpoint. No real key needed. Plans start at $9/month, or $90 once for 12 months with no auto-renewal.
Sources
- Doppler CLI: doppler run
- Infisical CLI: infisical run
- HashiCorp Vault documentation
- Vite: env variables and modes
Checked November 2026. Products change; if something here is out of date, email support@keyvaultedge.com and we'll fix it.