Secrets and password management application. Securely store, share, and manage sensitive credentials within your Frappe/ERPNext portal.
- Secure Storage: Store passwords, API keys, SSH keys, notes, credit cards, databases, and media files with encryption
- Folders: Organize secrets in a tree-based folder structure
- Access Logging: Track who accessed which secrets and when
- Sharing: Share secrets with specific users or roles
- Bookmarks: Mark frequently used secrets as bookmarks
- Dashboard: Visual overview with statistics and charts
- REST API: Full API access for browser extensions and integrations
This app is compatible with Frappe Framework:
| Vault Branch | Stability | Frappe Branch |
|---|---|---|
main - v1.x |
Stable | v15.x & v16.x |
develop - future/v2.x |
Unstable | develop |
- Frappe Framework v15+
- An active Frappe/ERPNext site
# Get the app
bench get-app https://github.com/lubusIN/frappe-vault.git
# Install on your site
bench --site your-site.local install-app frappe_vault# Clone the repository
cd ~/frappe-bench/apps
git clone https://github.com/lubusIN/frappe-vault.git
# Install the app
bench --site your-site.local install-app frappe_vault
# Enable developer mode (optional, for development)
bench --site your-site.local set-config developer_mode 1Frappe Vault uses Frappe's built-in encryption which relies on the site's encryption key. This is automatically configured when you set up your Frappe site.
To verify your encryption key is set:
bench --site your-site.local console
>>> from frappe.utils.password import get_encryption_key
>>> bool(get_encryption_key()) # Should return TrueIf you need to set an encryption key manually:
bench --site your-site.local set-config encryption_key "your-secure-32-byte-key-here"Important: Keep your encryption key secure and backed up. Losing it means losing access to all encrypted secrets.
Frappe Vault uses two custom roles:
- Vault User: Can create, read, update, and share their own secrets and folders
- Vault Admin: Administrative access to vault settings, policies, and audit logs
Assign these roles to users through the User DocType or Role Permissions Manager.
- Navigate to Frappe Vault > Vault Secret > New
- Enter a title and select the secret type
- Fill in the credentials (password, API key, etc.)
- Optionally assign a folder and tags
- Save
- Open a secret
- Go to the Sharing section
- Add users or roles with read/write permissions
- Set an optional expiration date
All secrets are accessible via REST API for integration with other applications.
# Get all secrets
curl -X GET "https://your-site.local/api/method/frappe_vault.api.secrets.list" \
-H "Authorization: token api_key:api_secret"
# Get a specific secret with decrypted password
curl -X POST "https://your-site.local/api/method/frappe_vault.api.secrets.decrypt" \
-H "Authorization: token api_key:api_secret" \
-H "Content-Type: application/json" \
-d '{"name": "VS-0001"}'
# Create a new secret
curl -X POST "https://your-site.local/api/method/frappe_vault.api.secrets.create" \
-H "Authorization: token api_key:api_secret" \
-H "Content-Type: application/json" \
-d '{"title": "My Secret", "secret_type": "Password", "password": "hunter2"}'Main document for storing credentials.
| Field | Type | Description |
|---|---|---|
| title | Data | Name/title of the secret |
| secret_type | Select | Password, API Key, Note, SSH Key, Media, Credit Card, Database, Other |
| folder | Link | Reference to Vault Folder |
| url | Data | Associated website/service URL |
| username | Data | Username for the credential |
| password | Password | Encrypted password field |
| api_key | Data | API key (for API Key type) |
| api_secret | Password | Encrypted API secret |
| notes | Text Editor | Additional notes |
| is_bookmark | Check | Mark as bookmark |
| password_strength | Select | Calculated password strength |
Organize your secrets into logical groups using folders.
Read-only audit log tracking all secret access.
- All passwords and secrets are encrypted using Frappe's built-in AES encryption
- Encryption relies on the site's encryption key stored in
site_config.json - Role-based access control (RBAC) using Frappe's Permission Manager
- Access logging for audit compliance
- Secrets are only accessible by owners or explicitly shared users/roles
Contributions are welcome! Please feel free to submit a Pull Request.
For issues and feature requests, please use the GitHub issue tracker.
Explore more open-source tools we're building for the Frappe ecosystem.
Create and manage local Frappe benches and sites visually. |
Run Frappe entirely in your browser. |
Discover community-built apps for Frappe. |
Connect WordPress and Frappe with a React data store. |
LUBUS is a web design agency based in Mumbai.
Frappe Vault is open-sourced licensed under the MIT License.