0.x · one Go binary · self-hosted
Hikyo gives self-hosting teams one view of validated configuration and secrets. Every value is explicit: see what is set, catch what is missing, and require deliberate access before sensitive values move.
MPL-2.0. Active 0.x development. No enterprise-only directory.
| Key | development | staging | production |
|---|---|---|---|
| database 3 | |||
| DATABASE_URL | ● set · secret | ● set · secret | ● set · secret |
| DATABASE_POOL_MAX | ✓ 10 | ✓ 20 | Δ 40 |
| DATABASE_SSLMODE | ✓ disable | ✓ verify-full | ✓ verify-full |
| payments 3 | |||
| STRIPE_SECRET_KEY | ○ absent | ● set · secret | ● set · secret |
| STRIPE_WEBHOOK_SECRET | ○ absent | ● set · secret | ! required · absent |
| PAYMENTS_MOCK_PROVIDER | ✓ true | ✓ false | ○ absent (forbidden) |
| observability 2 | |||
| LOG_LEVEL | ✓ debug | ✓ info | ✓ info |
| SENTRY_DSN | ○ absent | ● set · secret | ● set · secret |
| smtp 2all or none | |||
| SMTP_HOST | ○ absent | ✓ smtp.example.com | ✓ smtp.example.com |
| SMTP_PASSWORD | ○ absent | ! required · absent | ● set · secret |
1required here, absent: publish refuses
2Δ draft, unpublished
3forbidden, correctly absent
STRIPE_WEBHOOK_SECRET · productionrequired here, absent: publish refusesDATABASE_POOL_MAX · productionΔ draft, unpublishedPAYMENTS_MOCK_PROVIDER · productionforbidden, correctly absentBuilt for infrastructure you own
// one path from intent to runtime
Hikyo separates the shape of a key from each environment's value, then keeps delivery inside the same authorization model.
Choose config or secret, add validation, and state where the key is required.
key createReview draft values in the matrix, then publish a validated snapshot for delivery.
values publishFetch at runtime, render for Compose, reconcile Kubernetes, or use a declared adapter.
hikyo run// explicit state, deliberate access
A growing key catalogue across several environments should stay scannable. Hikyo makes absence visible and keeps secret material behind a separate disclosure path.
Values never fall through a hidden inheritance chain. Each cell is explicitly set or absent, so production cannot quietly borrow a development default.
▸ Flat values: no inheritance, no hidden fallback.
10set ✓20set ✓40set ✓3 environments · 3 explicit values · 0 fallbacks
Secrets stay masked until you deliberately reveal them within an authorized re-authentication window. Revealed values remask automatically, and clipboard copies become individual audited disclosures.
▸ Write-only replacement never needs the current plaintext.
••••••••••••value written to ./stripe-keyremask 0:18Key declarations distinguish config from secrets and attach validation rules. Edits and clears remain drafts until publication; invalid values or a missing required value block the new snapshot.
▸ A refused publication leaves the delivered snapshot unchanged.
secretdraftrequired_infail-closedA workload gets configuration through its scoped identity. Secret plaintext also requires the project machine-reveal opt-in and a reveal grant; otherwise delivery stops before the child starts.
▸ hikyo run injects values into the child environment without writing a plaintext file.
# start a process with an authorized environmenthikyo run -- ./payments-api ✓ identity verified ✓ grant constrained to project + environment ✓ config ready for the child process → secret plaintext needs explicit machine reveal ! inaccessible secret stops launch
// runs where you do
Self-hosting is the product, not a paid tier. Run one binary with its embedded web UI, choose SQLite or PostgreSQL, and hold the root key outside the datastore it protects.
// choose with the gaps visible
Hikyo starts with explicit environment state and validated values. OpenBao leads on dynamic infrastructure credentials; Infisical and Phase pair broad delivery workflows with paid tiers.
| Capability | Hikyofully open | OpenBao | Infisical | Phase |
|---|---|---|---|---|
| Self-hosted | ✓ | ✓ | ✓ | ✓ |
| Fully open production path | ✓ | ✓ | – | – |
| Config and secrets | ✓ | – | ✓ | ✓ |
| Explicit environment matrix | ✓ | ? | – | – |
| Declared value and environment presence validation | ✓ | ? | ? | ? |
| Workload plaintext delivery | ✓ | ✓ | ✓ | ✓ |
| Dynamic secrets | ✓ | ✓ | Adv | EE |
| Automated secret rotation | ◷ post-1.0 | ✓ | Pro | Pro |
| SCIM provisioning | ✓ | ? | EE | EE |
| Native multi-node HA | ✓ | ✓ | ✓ | – |
| Application-level recovery | ✓ | ✓ | Pro | ✓ |
✓ included– partial or indirect? not establishedAdv/Pro paid tierEE enterprise tier
Hikyo entries describe main-branch capabilities; the 1.0 roadmap records remaining release gates. Hikyo multi-node HA requires PostgreSQL. Clocks mark post-1.0 work without a promised minor version. Other products were checked against public documentation and plan availability on 9 October 2026: OpenBao,Infisical, and Phase. Question marks mean the linked sources do not establish an equivalent capability, rather than a verified absence. Paid-tier labels describe advertised plans; self-hosted licensing can differ.
// why Hikyo exists
Secrets products often make audit, SSO, SCIM, or recovery the reason to upgrade. Hikyo keeps the production path in the same open repository under the Mozilla Public License 2.0.
The environment matrix is the core idea: explicit state you can inspect, disclosure you must intend, and refusals that name the safe next action.
No badge wall. No hidden operational tier. Infrastructure you can reason about.
Built in the open · MPL-2.0 · no /ee
// before you evaluate it
Hikyo is open, self-hosted, and still pre-1.0. These boundaries matter before you place it near real configuration or secret material.
Read the complete documentationHikyo is under active 0.x development. Read the code, inspect the decisions, and follow the road to 1.0.