How Dopbase works
Dopbase is a self-hosted, open-source secrets manager. People manage application secrets, machines load one environment at runtime, and AI agents can inspect project structure without seeing secret values.
Runtime delivery
When the server is available, the CLI authenticates, retrieves one
environment, and starts your application with those values in process
memory. It does not write a shared .env file.
Swipe to view the full diagram.
Access by identity
A teammate, a deployment, and a coding agent should not share the same credential or permissions.
Use the Admin UI for day-to-day editing or sign in through the CLI for terminal work. Human accounts can create projects, separate environments, update secrets, and create runner tokens.
Root and admin accounts can also manage human users and AI accounts.
Manage projects, environments, secrets, and runner tokens.
CI jobs, servers, containers, and deployment tools use a runner
token tied to one environment. dopbase run loads that environment
and starts the application with the values in memory.
export DOPBASE_TOKEN=<runner-token>
dopbase run env_01ABCDEF -- ./payment-serviceOne environment. It cannot change or export secrets.
Give a coding agent a named service account when it needs to understand the project setup. It can read projects, environments, secret names, versions, and timestamps.
It cannot retrieve secret values, change data, list runner tokens, or read audit history.
Secret values stay outside the agent's access.
Run it yourself
One executable contains the server, Admin UI, REST API, migrations, and command-line client.