Docs

Start with the hosted quickstart, which goes from first login to export with the CLI, or the web console guide if you'd rather click. The guides set up one client each, and the reference covers the CLI, the API and the security model.

Start

• Hosted quickstartFrom first login to export with the edgekms CLI.
• Web consoleManaging tenants, keys, roles, policies and members at app.edgekms.dev.

Guides

• GitHub ActionsLog in from a workflow with GitHub's OIDC token, bound to a repository and branch.
• PulumiEncrypt a Pulumi stack's secrets with the hashivault secrets provider.
• SOPSEncrypt secrets files with SOPS and an edgekms Transit key.
• OpenBao auto-unsealUnseal OpenBao with seal "transit" and a revocable edgekms token.

Reference

• CLIInstalling the edgekms CLI, and the reference for every command.
• APIThe Vault-compatible endpoints, the tenant config, logins, tokens and the control API.
• Security modelKeys and wrapping, ciphertext, tokens, audit, the threat model, and leaving.
• Self-hostingRun the edgekms Worker in your own Cloudflare account.