TumblerKey

API key rotation for indie devs

Every key, back in line.

When the next breach hits, one panic button rotates, syncs and redeploys every API key you own, from one place.

Join the waitlistSee how it works
production5 keys, oldest 412 days
  • OPENAI_API_KEYage 214 days
  • RESEND_API_KEYage 187 days
  • SUPABASE_SECRET_KEYage 96 days
  • STRIPE_SECRET_KEYage 301 days
  • TELEGRAM_BOT_TOKENage 412 days

Your keys live in six dashboards. A breach means visiting all of them.

Copy from the provider, paste into Railway, paste into Vercel, update GitHub secrets, redeploy, hope nothing broke, revoke the old one. Then do it again for the next key.

Three steps. One line of code.

  1. Connect

    Link your key providers and your deploy targets. Project-scoped tokens only.

  2. Replace one line

    - process.env.OPENAI_API_KEY
+ await secrets.get("OPENAI_API_KEY")

  3. Rotate

    On a schedule or with the panic button. If anything fails, we roll back and keep the old key alive.

Integrations

Honest labels. Some providers allow full automation, some only a guided flow. Either way you paste a key at most once.

Tell us what to add next

Key providers

  • OpenAIauto
  • Resendauto
  • Supabaseauto
  • Stripeguided
  • Anthropicguided
  • Telegram botsguided
  • Google Geminisoon

Deploy targets

  • Railwayauto
  • Vercelauto
  • GitHub Actionsauto
  • Supabase Edgesoon
  • Expo EASsoon
  • Fly.iosoon

You’re trusting us with your keys. Here’s exactly what we do with them.

We don’t keep your key values

Once a key is delivered to your targets, we store only metadata and a hash.

Your own encryption key

Each account’s secrets are encrypted with a dedicated key. The master key lives in a KMS, never in our database.

Isolated decryption

Only an internal worker, not exposed to the internet, can decrypt. Our public API never can.

Open source, zero-dependency SDK

Read every line that runs in your app. Every release is published from CI with npm provenance.

Least privilege

We ask for project-scoped tokens, never account-wide ones. 2FA and re-authentication for the panic button.

You see everything

Every new SDK token, connected provider or rotation is logged and notified to you.

Report a vulnerability

Full automatic rotation. Flat price.

Not per identity, not per machine. Your bill doesn’t grow when you add a server.

Free

€0

  • 1 project
  • Env sync to your deploy targets
  • Guided manual rotation
  • Key inventory and age scanner
Start free

Indie

€15 /month

  • Up to 5 projects
  • Automatic scheduled rotation
  • Panic button
  • Email and Telegram alerts
Get Indie

Pro

€29 /month

  • Unlimited projects
  • Usage anomaly detection
  • Automation rules and webhooks
  • Small teams
Get Pro

Questions

What happens if your service goes down?

The SDK keeps the last valid keys in cache, so your app keeps running. Synced env vars already live on your platform.

What if a rotation fails?

We roll back to the previous key and never revoke the old one until the new one passes a health check.

Can I use it without the SDK?

Yes. We can sync your env vars to Railway, Vercel or GitHub Actions and trigger a redeploy.

Which providers can’t be fully automated?

Stripe, Anthropic and Telegram bot tokens can’t be created via API. We open the right page (or BotFather), you paste the new key once, and we verify it and handle the rest.

Be ready before the next breach.

Join the waitlist and tell us where you deploy.