For teams shipping on Stripe + Render

Keep secrets out of git.
Rotate keys on schedule — without breaking production.

Akita Vault gives you one command to vault env files, sync Stripe and Render, run the first rotation, and keep keys fresh on a monthly GitHub schedule — so you ship instead of firefighting leaks.

Start with Akita Vault — £25 intro See how it works

£25/org/year introductory · £49/yr standard from second renewal · one license, unlimited repos · vault-init --yes per project

The problem

Your secrets workflow is held together with hope

Most teams know they should rotate keys and keep .env out of git — but the playbook lives in someone's head, a Notion doc, or a one-off script that nobody trusts on a live app.

Committed by accident

API keys slip into history. Scrubbing git doesn't revoke what already leaked to GitHub, Slack, or a contractor's laptop.

Env files everywhere

.env.local, .env.production, Render dashboard, CI secrets — no single source of truth, easy to drift.

Rotation is a project

Stripe webhooks, AUTH_SECRET, admin tokens — each rotation is manual, scary, and postponed until after the incident.

The solution

Akita Vault — secure storage, sync, and schedule

A Cursor plugin + CLI workflow built for real stacks: bootstrap a gitignored vault/, symlink env for local dev, pull production from Render, rotate internal secrets and webhooks, and prove the automation bundle wasn't altered before it touches your APIs.

  • Non-destructive — backs up existing env files before moving them
  • Provider-aware — Stripe + Render first; expand to Vercel, Fly, Supabase
  • Scheduled — GitHub Actions monthly rotation with license gate
  • Signed — Ed25519 manifest verify before any destructive step
  • Licensed — cpk_live_ keys + online attestation API
Subscribe — Akita Vault
vault-init
$ vault-init --yes
→ bootstrap scripts + gitignored vault/
→ migrate .env* → vault/ (backup in .vault/backups/)
→ detect Render srv-… · Stripe acct_… · webhook URL
→ pull Render env → vault/render.env · vault:sync symlinks
→ gh secret set RENDER_API_KEY · STRIPE_SECRET_KEY
→ install .github/workflows/vault-rotate.yml
→ first rotation · Render deploy triggered
✓ Vault live — monthly schedule armed

How it works

Three steps. Then it runs itself.

  1. Install & license

    Copy the plugin, set AKITA_VAULT_LICENSE from checkout email, reload Cursor.

  2. Run once

    @vault-director or vault-init --yes from your repo root — migrates, connects, rotates, schedules.

  3. Stay current

    GitHub rotates monthly; pull fresh Render env locally with npm run vault:pull-render after CI.

What you get

Built for production, not slide decks

Vault bootstrap

Gitignored vault/, tracked .vault/config.json, symlinks for Prisma and Next.js — same pattern every repo.

Stripe + Render

Webhook recreation, internal token rotation, Render env push + deploy — uses your CLI keys, not the wrong Stripe MCP account.

GitHub automation

Workflow with AKITA_VAULT_LICENSE — rotation fails closed without a valid license.

Integrity gates

Signed SECURITY/MANIFEST.json — tampered scripts never reach your providers.

Cursor-native

Skills, rules, @vault-director agent, slash commands — fits how your team already ships.

Pair with Clear

Vault stores & rotates; Akita Clear scans source and strips literals before merge — complementary, not duplicate.

Honest comparison

Not a heavyweight vault. That's the point.

Enterprise secret platforms — HashiCorp Vault, AWS Secrets Manager, Doppler, 1Password Secrets Automation, Infisical Cloud — are built for centralized runtime secret injection, audit at scale, and platform teams. They are powerful. They are also expensive, slow to adopt, and overkill when your real problem is “.env files in git and nobody rotates the Stripe webhook.”

Heavyweight secret storage

HashiCorp · AWS · Doppler · 1Password · Infisical…

  • Hosted or self-run infrastructure (servers, agents, policies)
  • Pricing: per seat, per secret, or hundreds–thousands £/mo at team scale
  • Weeks of setup — namespaces, policies, IAM, SDK injection
  • Runtime fetch: apps call an API or sidecar at deploy time
  • Right when you need dynamic creds, PKI, SOC2 central audit, multi-cloud at scale

Akita Vault

£25 intro · £49/yr standard · unlimited repos

  • No secret server — gitignored vault/ per repo on your machine + provider dashboards
  • Flat annual price — not per developer seat or per stored secret
  • Minutes to live — vault-init --yes from Cursor or CLI
  • Opinionated connectors — Stripe + Render sync & rotation first (where indie teams actually ship)
  • Right when you want a repeatable dev workflow + scheduled rotation, not a company-wide secrets platform

Typical annual cost (indicative)

Team secret SaaS (~5 devs)
£600–£3,000+
Self-hosted Vault + ops time
£1,000+ infra + labour
AWS Secrets Manager (per-secret fees)
scales with secrets × envs
Akita Vault (1 org, any repos)
£25 (£49/yr)

Illustrative ranges for small teams — enterprise tiers and usage-based billing climb faster. Akita stays flat per org.

Choose enterprise vaults when…

You need dynamic database credentials, HSM-backed keys, org-wide audit exports, or every microservice pulling secrets at runtime from one control plane.

Choose Akita Vault when…

You ship on Render/Stripe (or similar), secrets live in .env files and dashboards, and you want them out of git, synced, and rotated on a calendar — without hiring a platform team.

Akita platform

Vault vs Clear — when to use which

Akita Vault £25 intro Akita Clear Free
Primary job Store secrets, sync providers, rotate on schedule Scan source, move keys to env, strip literals
Best for Live apps on Render/Stripe with real env sprawl Every repo before merge — dev & CI hygiene
Automation Monthly GitHub Actions + one-command init akita clear / @akita-secret-clear
Pricing £25/org/year intro · £49/yr standard · unlimited repos, one license Free (limited-time org offer)
Get started Subscribe GitHub sign-in

Pricing

One org. Many projects. One annual price.

£25/year introductory is not per repo. You buy one subscription per organization (one cpk_live_ license key). Standard renewal is £49/org/year. Run vault-init on as many repos as you need — each project gets its own gitignored vault/ folder and optional GitHub rotation workflow.

Per subscription 1 organization

One checkout · one license key · all devs on the same org can use it

Per org license Unlimited projects

Each repo = its own vault/ + .vault/config.json — not a shared cloud vault

Not included Extra orgs

Agency with multiple clients? One subscription per client org (separate license keys)

Akita Vault · launch offer

£25/org/year

Introductory first year · £49/yr standard from second renewal

One org license — use on every repo your team ships. Full init, rotation, GitHub schedule, signed releases.

  • 1 license key per org (not per project)
  • Unlimited repos — vault-init on each
  • Each project: own vault/ + rotation workflow
  • Stripe + Render connectors
  • cpk_live_ + online attestation API
  • 12 months plugin updates
Subscribe — £25 intro

Launch pricing applied at checkout · license key emailed after Stripe

Akita Clear

Free

CLI + Cursor plugin for scan, explain, move & clear — limited-time org offer.

  • akita clear full pipeline
  • MIT skills on storefront
  • GitHub repo access after sign-in
Continue with GitHub

Q&A

Questions & answers

Pricing, scope, and how Vault fits your stack.

Is £25 for one vault (one project) or many?

Many projects, one price. £25/year introductory buys one organizational license — not one repo. Standard renewal is £49/org/year. You receive a single cpk_live_ key (emailed after checkout). Use that same key on every repository in your org: run vault-init --yes (or @vault-director) from each project root.

Each repo gets its own gitignored vault/ folder and .vault/config.json — think “one license, many local vaults,” not one shared vault in the cloud. You do not pay £25 again per app unless you need a separate organization (e.g. a different client or company).

How is Akita Vault different from HashiCorp Vault, Doppler, or 1Password?

Those are centralized secret platforms — hosted stores or clusters your apps call at runtime, with per-seat or per-secret pricing and platform-team setup. Akita Vault is a developer workflow: gitignored vault/ folders in your repos, symlinks for local dev, and automated sync/rotation to Stripe + Render.

You are not buying a secret server. You are buying a Cursor plugin + automation that stops env sprawl and makes rotation a scheduled habit — at £25/org/year introductory (£49/yr standard) instead of hundreds or thousands for team SaaS or self-hosted Vault ops. Many teams use both later: Akita to clean up shipping, enterprise vault when compliance demands central runtime injection.

What happens after the introductory year?

Your subscription renews at the standard £49/org/year rate unless we announce a change in advance. You keep the same cpk_live_ license key and all repos you have already initialized — no per-repo fees. Cancel anytime from the Stripe customer portal linked in your receipt email.

Vault only vs Enterprise Delivery Stack?

Akita Vault only (£25 intro / £49/yr standard) — secrets workflow + rotation for teams on Stripe + Render. Enterprise Delivery Stack (£299 intro / £499/yr standard) — all paid CPK plugins, the same cpk_live_ Vault license, install-stack.mjs, and onboarding call. Brand DNA is a separate platform add-on when you are ready.

Buy Vault on plugins or the full stack on enterprise.

What counts as one “org”?

The organization tied to your purchase — typically your company domain on the Stripe checkout email (e.g. everyone at @acme.com shipping repos under Acme). One license key per checkout. Consultancies billing multiple clients should purchase one subscription per client org.

How do multiple repos share the license?

Set AKITA_VAULT_LICENSE in your environment, store the key in each repo’s .akita/licenses.json, or add AKITA_VAULT_LICENSE as a GitHub Actions secret per repository that runs monthly rotation. The license API validates the same key across projects — no per-repo fee.

Will this break my existing project?

Bootstrap is dry-run first. Real env files are backed up to .vault/backups/ before migration. Rotation always previews before apply.

What about Stripe sk_live rotation?

Vault rotates webhooks and internal tokens automatically. Full API key rotation still uses Stripe's 7-day grace in the Dashboard — we document the exact steps in your vault runbook.

Do I need both Vault and Clear?

Recommended: Clear before every merge (source hygiene), Vault for storage, provider sync, and scheduled rotation on deployed apps. Clear is free; Vault is the paid automation layer.

How is the plugin protected from tampering?

Ed25519-signed release manifest verified before init/rotate. Paid features require cpk_live_ validation against our license API.

Is there a team or enterprise tier?

Vault is £25/org/year introductory today (£49/yr standard from second renewal). Team seats and hosted rotation are on the roadmap — contact hello@cursorpluginkits.com if you need multi-org billing or SSO.

Akita Clear FREE

akita clear — scan, explain, move keys to env, strip literals, verify. No credit card.

Get free access · GitHub MIT skills
Free tier details — CLI, plugin & commands

CLI

Akita Clear

One command does it all — scan, explain, move keys to env, strip literals, verify.

  • akita clear — full pipeline
  • akita clear --dry-run — preview first
  • 9 patterns · Keychain + GitHub providers

Plugin

Akita Clear in Cursor

Invoke the same pipeline from chat — rules and hooks keep CI and IDE in sync.

  • @akita-secret-clear → akita clear
  • Always-on akita-secrets.mdc rules

Akita Clear — one command

$ akita clear
→ scan… 2 findings — api_key in src/config.ts:14
→ move 2 keys → .env · strip 2 literals
✓ Clean.Secure.Ship — 0 findings

Secure your stack this week

Subscribe to Akita Vault for automation, or start free with Akita Clear and upgrade when you're ready to rotate on schedule.

Subscribe — £25 intro Akita Clear — free