Keymaster & Gatekeeper: A Developer-Friendly Approach to Secrets Management

Managing API keys, credentials, and other secrets across multiple websites can quickly become a headache. What happens when a credential needs to be rotated? How do you securely share credentials across sites without duplicating them everywhere? And how can applications access external services without exposing the underlying keys?

Keymaster and Gatekeeper are two open-source projects I'm building to address these challenges.

Keymaster is a centralized secrets management service that allows developers to securely store, distribute, and rotate credentials across multiple websites and applications. It supports encrypted secrets, per-site access controls, and secure communication between registered sites.

Gatekeeper takes things a step further by acting as a secure API relay. Applications can request data from external services without ever receiving or storing the credentials used to access them.

In this session, I'll walk through the architecture, demonstrate the work so far, and discuss how these tools can simplify credential management for developers, agencies, and organizations maintaining multiple websites.

We'll also explore the integration with Backdrop CMS, the security challenges involved, and where the projects are headed next.

This is a practical look at building developer-friendly security infrastructure with open-source tools.