# varsafe — secure secrets management for developers and teams

> The Markdown representation of https://varsafe.dev/. For a machine-oriented orientation to the
> whole product, read [/llms.txt](https://varsafe.dev/llms.txt) instead.

varsafe stores environment variables — database URLs, API keys, signing secrets — encrypted at rest,
and hands them to the process that needs them without writing a `.env` file to disk.

```bash
curl -fsSL https://varsafe.dev/install.sh | bash
varsafe login
varsafe run -p api -e production -- ./deploy.sh
```

## What it does

- **Injects, rather than exports.** `varsafe run` passes secrets to a child process and nothing
  else. There is no file to forget to delete and nothing for a stray `git add .` to catch.
- **Encrypts in transit and at rest.** Values are encrypted before storage; the dashboard and the
  CLI are the only ways to see them, and both are audited.
- **Records every access.** An append-only audit trail names who read which secret, from where, and
  when. Retention is 7 days on the free plan and 90 days on Team.
- **Scopes access narrowly.** An API token can be limited to one project, one environment and
  read-only. A CLI grant carries only the scopes the person approving it consented to.
- **Speaks MCP.** AI agents connect over the Model Context Protocol with OAuth 2.1 and per-tool
  scopes, so an agent can list secret keys without being able to read their values.
- **Runs in the EU.** One region, in the European Union, operated under the GDPR.

## Getting started

1. Install the CLI: `curl -fsSL https://varsafe.dev/install.sh | bash`
2. Create a free account: <https://varsafe.dev/login?register=true> — $0 for up to 3 users, no card.
3. `varsafe login`, then `varsafe use` to pick a project and environment.
4. `varsafe run -- your-command`.

The five-minute version is at <https://docs.varsafe.dev/getting-started>.

## For automation and agents

- REST API: <https://api.varsafe.dev> — OpenAPI at <https://varsafe.dev/openapi.json>
- MCP endpoint: <https://api.varsafe.dev/mcp> — manifest at
  <https://varsafe.dev/.well-known/mcp.json>
- CI/CD guide: <https://docs.varsafe.dev/guides/ci>

## Pricing

- **Developer** — $0, up to 3 users, unlimited projects and environments, 7-day audit history.
- **Team** — $15/user/month ($12 billed annually), SSO, 90-day audit history, secret versioning,
  priority support. 14-day trial.

Details: <https://varsafe.dev/pricing>

## Links

- Documentation: <https://docs.varsafe.dev>
- About: <https://varsafe.dev/about>
- Contact: <https://varsafe.dev/contact> or support@varsafe.dev
- Status: <https://status.varsafe.com>
- Privacy: <https://varsafe.dev/privacy> · Terms: <https://varsafe.dev/terms>