KeyRack review
A self-hosted key-routing service for teams managing providers, policies and HSM operations.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
KeyRack is an open-source key management service that runs in an organization's infrastructure. It is designed for developers and platform teams that need self-hosted key routing across software providers, HSMs, Vault Transit and KMIP. Its audience includes regulated industries, multi-cloud platforms, SaaS providers and OpenStack operators. The service provides gRPC and REST APIs, supports customer-controlled HSM and KMIP backends through HYOK configurations, and is available under AGPL-3.0-or-later.
Its strongest differentiator is coordination across key hierarchies and providers. Hierarchical key trees support namespace-scoped rules and cascade operations, while multi-provider routing enables cross-provider re-encryption. HSM-backed cryptographic operations add hardware-backed handling, and external Cedar or OPA policy decision point integration allows policy decisions to remain part of an existing control model. These capabilities make KeyRack a focused fit for teams that need routing and policy coordination rather than a single-provider key service.
KeyRack also fits infrastructure teams that need structured, verifiable audit trails. It can emit audit events through NATS, files or stdout, with BLAKE3 hash chaining and optional Ed25519 signing for verification. Integrations include AWS KMS, OpenStack Barbican, PostgreSQL, SQLite, Docker Compose, Kubernetes, OIDC and mTLS, while AWS KMS and OpenStack Barbican compatibility is available through commercial extensions. Teams should choose KeyRack when they can operate self-hosted infrastructure and value open-source control, provider flexibility and HYOK. Organizations seeking a fully managed service or public numeric pricing for commercial extensions should consider alternatives.
KeyRack pros and cons
- Where it wins
- Hierarchical key trees support namespace-scoped rules and cascade operations
- Routes across software, PKCS#11, Vault Transit and KMIP providers
- Tamper-evident audit verification with BLAKE3 and optional Ed25519 signing
- Where it doesn't
- Self-hosted deployment requires infrastructure managed by the adopting organization
- Commercial extensions use contact-based pricing
- Automatic scheduled rotation and key import are outside the documented scope
KeyRack fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update