Key Robot vs HashiCorp Vault
Updated October 2026
HashiCorp Vault is for a team with the staff to run its own secrets infrastructure, or the budget for HCP's managed version. Key Robot is for a developer who wants a key to rotate without running any infrastructure at all.
Side by side
| What it does | Where keys live | Rotation | Price | Best for | |
|---|---|---|---|---|---|
| HashiCorp Vault | Full secrets engine, rotates almost any credential type | Vault, self-hosted or HCP-managed | Built in, once Vault is running and configured | Free self-hosted (BSL) to $1,150+/mo plus $73-$113 per client on HCP | A team with someone to run Vault, or budget for HCP |
| Key Robot | Changes your keys on a schedule and deletes the old ones | Your own encrypted GitHub Actions secrets | Daily, automatic, included free | Free for one app. Pro for all apps: $19/month | A developer with no one to run infrastructure for this |
HCP's own pricing page lists a dev tier around $0.03 an hour, about $22 a month, for testing, checked October 24, 2026. Production tiers run $1,150 to $6,900 a month, plus $73 to $113 per connected client a month on top of that. That per-client fee is the opposite of Key Robot's model, where adding another app doesn't add a per-unit charge like this.
When to pick HashiCorp Vault
Pick Vault if you need to rotate many different kinds of credentials, not just API keys, database passwords, certificates, cloud IAM roles, and you have someone who can own installing it, patching it, and keeping it available. That's a real job, and Vault earns its reputation once that job is staffed.
When to pick Key Robot
Pick Key Robot if you don't have anyone to run Vault, and the per-client HCP pricing doesn't make sense for one or two apps. Key Robot runs in your own GitHub Actions instead of infrastructure you manage. It locks each key in your browser before anything is sent, saves it as an encrypted GitHub Actions secret, and never stores the key on its own server.
Every day, for a connected service, it makes a new key, checks your app still works, and deletes the old one. If the check fails, the old key comes back by itself. A Kill it now button handles a key that leaked right now. We timed it on our own demo app on October 23, 2026: 82 seconds from pressing the button to the old key being dead.
Today that's Neon, Resend and Supabase keys, for apps hosted on Netlify or Vercel. Cloudflare and OpenAI are built and being tested. Free for one app, no card.
The honest gap
Vault can rotate almost anything, across almost any kind of credential, once it's running. Key Robot only rotates the specific services it supports, and runs nothing you have to patch or keep alive. If your rotation needs are broad and you have the staff, Vault is the deeper tool. If your need is narrower and you'd rather not run infrastructure at all, Key Robot gets there for free.
See Key Robot vs AWS Secrets Manager for the other option teams reach for before Vault, or the best API key rotation tools ranked for the full field.
Questions
Is HashiCorp Vault free?
Self-hosting Vault's open source edition is free, but you run and patch it yourself. HCP Vault Dedicated's dev tier is about $22 a month, and production tiers start around $1,150 a month plus $73 to $113 per connected client.
Does Vault rotate keys for free once it's running?
Yes, rotation is a core Vault feature once it's set up. The cost isn't the rotation feature, it's standing up and maintaining Vault itself, or paying HCP's per-client fee at scale.
Is Key Robot a replacement for Vault?
Not for everything Vault does. Key Robot doesn't run as infrastructure you manage, and it only rotates the specific services it supports. For those services, it's simpler and free.