Cloud Parts

Doppler

A hosted secrets manager built for developers: one place for every app’s config and secrets per environment, injected with doppler run and synced out to clouds and CI.

What it is
Secrets management
Type
Commercial product
Made by
Doppler
License
Proprietary SaaS; the CLI and Kubernetes operator are Apache 2.0
Facts checked
8 October 2026
Website

What it is

Doppler organizes secrets by project, one per app or service. Each project starts with three environments (Development, Staging and Production), and each environment has a root config (dev, stg, prd) holding its secrets as key-value pairs. Branch configs override a root config for one cloud, feature or person; every developer gets a private dev_personal branch by default. A secret can reference another with ${SECRET_NAME}, and on paid plans across configs and projects; config inheritance (also paid) shares common secrets from one config into others. Every change is logged like git log, every version of a secret is kept, and a change can be rolled back from the log.

Apps get secrets in two ways. The open-source CLI injects them at start-up: doppler run -- npm start fetches the config tied to the directory by doppler setup and passes it as environment variables, or --mount exposes them as an ephemeral .env or JSON file on a named pipe that disappears when the process exits. The CLI also keeps an encrypted fallback copy so an app can start when Doppler is unreachable. Or Doppler pushes secrets out: config syncs keep AWS Secrets Manager, GitHub Actions secrets, Vercel environment variables and others up to date, and a Kubernetes operator syncs configs into Kubernetes Secrets and can restart the deployments that use them. Behind the API, secrets are swapped for opaque tokens by a tokenization service that encrypts them with AES-GCM and a per-workplace 256-bit key, wrapped by a Google Cloud KMS key backed by a hardware security module.

Why teams pick it

  • Fast to adopt: doppler run injects secrets into almost any command without code changes, and personal branch configs replace shared .env files
  • One source of truth that syncs out to AWS Secrets Manager, GitHub, Vercel, Kubernetes and more, so CI and runtimes stay in step
  • History and rollback for every secret, with change requests and approval policies on paid plans
  • Per-seat pricing: free for 3 users on the Developer plan, then $8 a month per extra user; Team is $21 per user a month

Watch out for

  • A hosted service: secrets live in Doppler’s Google Cloud region (us-central1) unless you buy the Enterprise on-prem option
  • Rotation needs the Team plan, and dynamic secrets (short-lived leases, 30 minutes by default) only come with Enterprise
  • Plan limits shape the design: the Developer plan allows 10 projects, 4 environments per project, 5 config syncs and 3 days of activity logs
  • Environment variables are a blunt channel: names such as LD_PRELOAD can even lead to remote code execution, and Doppler itself recommends mounting an ephemeral file instead

Alternatives

What all secrets management have in common →
Cloudflare Secrets StoreBetaCommercialAccount-level secrets that are written once, can never be read back, and are bound by reference into any Worker or AI Gateway that needs them.HashiCorp VaultCommercialA secrets server that can mint short-lived database and cloud credentials on demand, not just store passwords.HCP Vault RadarCommercialA hosted scanner that finds leaked secrets and personal data in code, wikis, tickets and chat, checks which ones still work, and helps move them into Vault.

How it fits with other technologies

Link a directory to a config, then inject or mount its secrets · bash

doppler login                               # opens the browser once
doppler setup --project api --config dev   # ties this directory to api/dev

doppler secrets set STRIPE_KEY=sk_test_123

# secrets arrive as environment variables of the child process
doppler run -- npm start

# or as an ephemeral .env file on a named pipe, gone when the process exits
doppler run --mount .env -- npm start

# in CI or production, a scoped token replaces the login
DOPPLER_TOKEN="$TOKEN" doppler run -- ./server

See it in a real stack

No architecture uses Doppler yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2018–2026

Brian Vallelunga founded Doppler in 2018, after a stint as a software engineer on Uber’s app safety team and four earlier startups. His view was that existing secrets tools were “designed by security engineers, for security engineers” and cumbersome for developers, so he set out to build what he called a “SecretsOps” platform for developers and their teams. Doppler went through Y Combinator in Winter 2019, where Vallelunga met his co-founder Thomas Piccirello, a former BlackRock engineer.

The current Go-based CLI, with doppler run, had its first releases in November 2019, and the Kubernetes operator followed in June 2021. In April 2022 Doppler raised a $20 million Series A led by CRV, with GV, Sequoia Capital and Y Combinator, for $28.8 million raised in total. It then said 16,000 organizations used it, served more than 1.5 billion secrets a month, and named HashiCorp Vault as its closest rival. It promised a pull-request flow for secrets, rotation and dynamic secrets to move teams off long-lived static credentials; all three now exist as change requests, rotated secrets and dynamic secrets.

Why it’s built this way

Developer experience first
Vallelunga argued that tools built by security engineers were cumbersome and ignored the developer experience. Doppler wraps any process with one CLI command, so an app reads its secrets the way it already does, from environment variables or a file.
A hosted service with tokenized storage
Running it for customers removes the servers to operate. To limit the blast radius, web servers store only opaque tokens, and a separate service holds the encryption keys in memory during a request.
Sync to where apps already read secrets
Rather than make every platform call Doppler, it pushes configs into AWS Secrets Manager, GitHub, Vercel or Kubernetes Secrets, so existing deployments keep working unchanged.

Timeline

  1. 2018

    Founded by Brian Vallelunga

  2. 2019

    Joins Y Combinator’s Winter 2019 batch; Go CLI first released in November

  3. 2021

    Kubernetes operator released in June

  4. 2022

    $20M Series A led by CRV in April; 16,000 organizations as customers

  5. 2026

    Plans: Developer free for 3 users, Team $21 per user a month, Enterprise custom

Sources20 · facts checked 8 October 2026

Improve this page on GitHub