What is Fally?
Fally is an API key manager for teams. It stores your third-party vendor API keys — Stripe, OpenAI, GitHub, AWS and the rest — with the context a raw string can't carry: who owns each key, what it's for, and which team and environment it belongs to. So anyone on the team can tell two similar keys apart, and you always know what to rotate when someone leaves.
How is Fally different from Infisical, Doppler, or 1Password?
Infisical and Doppler store secrets and inject them into your runtimes — apps, CI, Kubernetes. Fally works the human side instead: inventory, ownership, handoff, and offboarding of vendor API keys. 1Password manages general passwords for individuals; Fally is built specifically for a team's API keys, with a required owner and purpose on every one.
Does Fally inject secrets into my app at runtime?
No. Fally is where your keys live with their provenance — you find, reveal, copy, rotate, and hand them off from here. It doesn't push values into running apps, CI, or Kubernetes, and it doesn't create keys inside vendor consoles. That keeps the security surface small and the product focused.
How are my secrets encrypted?
Every value is encrypted with envelope encryption (AES-256-GCM) before it's written, so the database never holds a plaintext secret. Each encrypted value is bound to its own project and key, so ciphertext can't be lifted and read from another row, and the master key can be rotated without downtime. Secret values are never logged.
Can I use Fally from the command line or with AI agents?
Yes. The fally CLI lists, reveals, copies, creates, rotates, and transfers keys from your terminal. An MCP server (fally-mcp) lets AI agents read key metadata; revealing actual values over MCP stays off until a project admin turns it on, and the agent's token is scoped so it can't do anything else.
What happens when someone leaves the team?
Open the offboarding flow, pick the person, and Fally lists every key they own. Reassign all of it to someone else in one step, then remove them from their teams — and the whole thing is written to the audit log. No more hunting through vendor consoles to find what a departing engineer was holding.
Does Fally support single sign-on (SSO)?
Yes — OIDC single sign-on is available on the Business plan. You prove your domain with a DNS TXT record, then logins for that domain route through your identity provider. You can also require SSO, which turns off password sign-in everywhere, including the CLI.
How much does Fally cost?
Fally is billed per person, never per key or machine. Free covers up to 5 people with unlimited keys. Team is $8 per person / month and adds bulk offboarding, ownership transfer, and CLI write. Business is $14 per person / month and adds OIDC single sign-on, multiple projects, and a one-year exportable audit trail.
