Key Robot vs AWS Secrets Manager
Updated October 2026
AWS Secrets Manager is for a team already running on AWS that's comfortable wiring up its own rotation code. Key Robot is for a developer who wants a key to rotate without writing or running any rotation code at all.
Side by side
| What it does | Where keys live | Rotation | Price | Best for | |
|---|---|---|---|---|---|
| AWS Secrets Manager | Stores secrets and runs rotation you configure | AWS, inside your own account | Included, but you write and run the Lambda | $0.40 per secret/mo + $0.05 per 10,000 calls, no free tier | A team already on AWS, comfortable with Lambda |
| Key Robot | Changes your keys on a schedule and deletes the old ones | Your own encrypted GitHub Actions secrets | Daily, automatic, included free, no code to write | Free for one app. Pro for all apps: $19/month | A developer who wants rotation without writing rotation code |
AWS's own pricing page states the charge plainly: $0.40 per secret per month, plus $0.05 per 10,000 API calls, checked October 24, 2026. Rotation itself doesn't add to that number. The same page says rotating a secret creates a new version you aren't billed for separately. There is no free tier, so storing even one secret costs something from day one.
When to pick AWS Secrets Manager
Pick AWS Secrets Manager if your app already runs on AWS, and you're willing to build or adapt a rotation Lambda for each kind of secret you have. The per-secret price is the cheapest on this page at scale, and rotation is genuinely included, not a paid add-on. The cost is your own time, writing and maintaining that rotation code.
When to pick Key Robot
Pick Key Robot if you'd rather not write rotation code, or your app doesn't live on AWS at all. Key Robot runs in your own GitHub Actions. It locks each key in your browser before anything is sent, and saves it as an encrypted GitHub Actions secret, never on Key Robot's own server. Every day, for a connected service, it makes a new key, checks your app still works, and deletes the old one, with no Lambda to write. If the check fails, the old key comes back by itself. A Kill it now button handles a leak right now. We timed it on our own demo app on October 23, 2026: 82 seconds from pressing the button to the old key being dead.
Today that's Neon, Resend and Supabase keys, for apps on Netlify or Vercel. Cloudflare and OpenAI are built and being tested. Free for one app, no card.
The honest gap
AWS Secrets Manager can rotate almost any kind of secret, once you've written the Lambda for it, and it fits naturally if your infrastructure is already on AWS. Key Robot writes no code for you to review, it just runs the rotation for the specific services it already supports. If you want full control over rotation logic and you're on AWS already, AWS Secrets Manager earns its place. If you want a key to change without building anything, Key Robot gets there faster for the services it covers.
See Key Robot vs HashiCorp Vault for the other self-run option, or the rotate hub for exact service-by-service status.
Questions
Is rotation free on AWS Secrets Manager?
The rotation feature itself is included at no extra charge. You still pay $0.40 per secret a month for storage, plus $0.05 per 10,000 API calls, and you pay for the Lambda function that actually does the rotating.
Do I need to know AWS to use Secrets Manager?
Yes. You write or adapt a rotation Lambda for each type of secret, and you need an AWS account to run it. There's no free tier at all, even for one secret.
Does Key Robot need AWS?
No. Key Robot runs in your own GitHub Actions. It doesn't require an AWS account or any Lambda code.