Laravel Keep is a toolkit for managing application secrets across environments and teams.

Key Features:

• CLI Commands - Manage individual secrets, import/export in bulk, view history and diffs, all via artisan commands
• Multi-Vault Support - Driver-based system (AWS SSM Parameter Store, AWS Secrets Manager, extensible for other providers)
• Environment Isolation - Separate secrets by environment (local, staging, production) with access controls
• Template System - Merge secrets into .env files using template placeholders
• Team Collaboration - Share secret management across team members with proper access controls
• CI/CD Integration - Export secrets for deployment pipelines and automated workflows

The package provides a secure, organized way to manage Laravel application secrets without storing them in version control or sharing them insecurely.

You can install the package via composer:

composer require stechstudio/laravel-keep

Let's say you have three environments (local, staging, production) and you want to store secrets in AWS SSM Parameter Store with the default KMS encryption key, in the us-east-1 region. (You can also use AWS Secrets Manager - see configuration docs for details.)

1. Install the package via composer (as shown above).
2. Ensure you have AWS credentials configured in your environment, with permissions to access SSM Parameter Store (see docs for full example).
3. Run php artisan keep:verify to check your setup, verify your vault configuration, and ensure you have necessary permissions.

You can add secrets using the artisan command:

# You will be prompted for the stage and secret value
php artisan keep:set DB_PASSWORD

# Or specify the stage and value directly
php artisan keep:set DB_PASSWORD --stage=production --value="supersecretpassword"

This will store the DB_PASSWORD secret in AWS SSM under the path /[app-name-slug]/production/DB_PASSWORD.

Check that the secret was added:

# Retrieve a single secret
php artisan keep:get DB_PASSWORD --stage=production

# List all secrets for production
php artisan keep:list --stage=production

If 100% of your .env variables are managed via Keep, you can export them all to a .env file as part of your deployment process:

php artisan keep:export --stage=production --output=.env

You can also have a template env file with some non-sensitive values and merge the secrets into it:

Example .env.base template:

APP_NAME=MyApp
# ...
DB_DATABASE=myapp_db
DB_PASSWORD={ssm:DB_PASSWORD} # or just {ssm} since the key matches the variable name

Then run the merge command:

php artisan keep:merge --template=.env.base --output=.env --stage=production

You will now have a .env file with all the values from the template and the secrets filled in.

The MIT License (MIT). Please see License File for more information.