Frappe Vault

Secrets and password management application. Securely store, share, and manage sensitive credentials within your Frappe/ERPNext portal.

• Secure Storage: Store passwords, API keys, SSH keys, notes, credit cards, databases, and media files with encryption
• Folders: Organize secrets in a tree-based folder structure
• Access Logging: Track who accessed which secrets and when
• Sharing: Share secrets with specific users or roles
• Bookmarks: Mark frequently used secrets as bookmarks
• Dashboard: Visual overview with statistics and charts
• REST API: Full API access for browser extensions and integrations

This app is compatible with Frappe Framework:

• Frappe Framework v15+
• An active Frappe/ERPNext site

# Get the app
bench get-app https://github.com/lubusIN/frappe-vault.git

# Install on your site
bench --site your-site.local install-app frappe_vault

# Clone the repository
cd ~/frappe-bench/apps
git clone https://github.com/lubusIN/frappe-vault.git

# Install the app
bench --site your-site.local install-app frappe_vault

# Enable developer mode (optional, for development)
bench --site your-site.local set-config developer_mode 1

Frappe Vault uses Frappe's built-in encryption which relies on the site's encryption key. This is automatically configured when you set up your Frappe site.

To verify your encryption key is set:

bench --site your-site.local console
>>> from frappe.utils.password import get_encryption_key
>>> bool(get_encryption_key())  # Should return True

If you need to set an encryption key manually:

bench --site your-site.local set-config encryption_key "your-secure-32-byte-key-here"

Important: Keep your encryption key secure and backed up. Losing it means losing access to all encrypted secrets.

Frappe Vault uses two custom roles:

• Vault User: Can create, read, update, and share their own secrets and folders
• Vault Admin: Administrative access to vault settings, policies, and audit logs

Assign these roles to users through the User DocType or Role Permissions Manager.

1. Navigate to Frappe Vault > Vault Secret > New
2. Enter a title and select the secret type
3. Fill in the credentials (password, API key, etc.)
4. Optionally assign a folder and tags
5. Save

1. Open a secret
2. Go to the Sharing section
3. Add users or roles with read/write permissions
4. Set an optional expiration date

All secrets are accessible via REST API for integration with other applications.

# Get all secrets
curl -X GET "https://your-site.local/api/method/frappe_vault.api.secrets.list" \
  -H "Authorization: token api_key:api_secret"

# Get a specific secret with decrypted password
curl -X POST "https://your-site.local/api/method/frappe_vault.api.secrets.decrypt" \
  -H "Authorization: token api_key:api_secret" \
  -H "Content-Type: application/json" \
  -d '{"name": "VS-0001"}'

# Create a new secret
curl -X POST "https://your-site.local/api/method/frappe_vault.api.secrets.create" \
  -H "Authorization: token api_key:api_secret" \
  -H "Content-Type: application/json" \
  -d '{"title": "My Secret", "secret_type": "Password", "password": "hunter2"}'

Main document for storing credentials.

Organize your secrets into logical groups using folders.

Read-only audit log tracking all secret access.

• All passwords and secrets are encrypted using Frappe's built-in AES encryption
• Encryption relies on the site's encryption key stored in site_config.json
• Role-based access control (RBAC) using Frappe's Permission Manager
• Access logging for audit compliance
• Secrets are only accessible by owners or explicitly shared users/roles

Contributions are welcome! Please feel free to submit a Pull Request.

For issues and feature requests, please use the GitHub issue tracker.

LUBUS is a web design agency based in Mumbai.

Frappe Vault is open-sourced licensed under the MIT License.