End-to-end sealed config

Config and secrets we can never read

Declare typed settings as schema, seal secrets client-side, and resolve frozen config at the edge. OrbSeal stores ciphertext and never holds your private keys.

Start free See how it works
orbseal sync ./orb.yaml - schema pushed, secrets stay sealed, resolved in one edge hop.

Zero-knowledge by design

Your secret key never leaves your app.

app keypub_2fK9...q7Z | 44 chars
plaintextsk_live_51Jx... (your machine)
at restAY8c1pP...sealed ciphertext...u0=
orbsealcan_open = false

Even with database access, values stay opaque without your private key.

Sealed boxes

Secrets are encrypted with libsodium sealed boxes against your public key.

Ciphertext only

The control plane never sees plaintext and cannot decrypt stored values.

Decryption is yours

SDKs open secrets inside trusted server code, never in the browser.

The flow

From schema to resolved config in four moves.

Write it once in code. Set values where they belong. Release a frozen snapshot. Resolve it anywhere.

01 / Declare

Schema as code

Define keys, types, scopes, and override rules in orb.yaml.

02 / Set

Values by scope

Set workspace, project, environment, and user values. Secrets are sealed client-side.

03 / Release

Immutable release

Freeze a versioned snapshot, cached at the edge by project, environment, and version.

04 / Resolve

Runtime resolve

Pull a typed bundle with one SDK call and merge the most specific values.

user>environment>project>workspace>defaultmost specific wins

Built for developers

Two files. That's the integration.

orb.yaml
plugin: taskflow
definitions:
  api_url:
    type: string
    scope: environment
    required: true
  max_retries:
    type: number
    scope: project
    default: 3
  queue_name:
    type: enum
    values: [default, priority, batch]
    scope: environment
  webhook_secret:
    type: secret
    scope: environment
worker.ts
import { ConfigClient } from "@dotlabshq/orbseal-sdk";

const orb = new ConfigClient({
  apiKey: process.env.ORBSEAL_API_KEY!,
  project: "taskflow",
  environment: "production",
});

const config = await orb.resolve();
const apiUrl  = config.get("api_url");
const retries = config.get("max_retries");
const secret  = await config.getSecret("webhook_secret");

What you get

A control plane that stays out of your way.

// schema

Typed, validated keys

String, number, boolean, enum, json, and secret values validated before release.

// scopes

Inheritance and overrides

Safe defaults at the top, precise overrides below: workspace, project, environment, user.

// snapshots

Versioned and immutable

Every release is frozen and ETag-addressed. Roll back quickly; cache confidently.

// sdk + cli

SDK and CLI

Sync orb.yaml, export env files, resolve typed config, and open secrets inside trusted code.

// audit

Every change logged

Track who changed what, when it shipped, and which app key resolved it.

Pricing

Free to start. Sealed at every tier.

End-to-end encryption is never an upsell.

Free
$0 forever

For solo builders and side projects.

  • 1 workspace, 3 projects
  • 3 environments per project
  • 100 config keys
  • Sealed-box E2E secrets
  • 50k resolves / month
  • 7-day audit history
Start free
Coming soon
Pro
$20 / year

For teams shipping real products.

  • Unlimited projects and environments
  • 5 team members included
  • 10,000 config keys
  • 1M resolves / month
  • 90-day audit history
  • Role-based access