Yeah, "easy integration" is more speaking to how you get secrets from Vault/EnvKey through to an app. Dynamic secrets generation isn't built in to EnvKey, but

Yeah, "easy integration" is more speaking to how you get secrets from Vault/EnvKey through to an app. Dynamic secrets generation isn't built in to EnvKey, but we do offer a CLI that makes it straightforward to generate or rotate credentials/roles as part of your deployment. Rather than baking in this kind of thing, we are more taking a 'give you simple building blocks so you can do anything' approach to automations. For your postgres example, it would look something like this: # Set variables for an EnvKey environment that includes postgres admin creds in shell eval $(envkey-source) # Use the admin credentials from EnvKey to rotate credentials for app role in Postgres. # You could also create new roles, grant privileges, etc., as needed. NEW_PASSWORD=$(openssl rand -base64 32) psql -h $DB_HOST -U $DB_ADMIN_USER -d $DATABASE_NAME -c "ALTER ROLE $ROLE_NAME WITH PASSWORD '$NEW_PASSWORD';" # Update the credentials in EnvKey for your app. envkey set app-name production DB_PASSWORD=$NEW_PASSWORD --commit --json Meanwhile, if you prefix your app start command like this: envkey-source --watch -- ./run-my-app.sh Your app process will then be automatically restarted after the `envkey set` command with the latest postgres password in its environment. If you're running multiple instances, you could also use rolling restarts to avoid downtime. envkey-source --watch --rolling -- ./run-my-app.sh So it's a bit more work compared to Vault for the postgres use-case, but on the other hand, with EnvKey you get a lot of flexibility to setup these kinds of automations for any service or tool. For acting as a CA, we have some ideas on how to accomplish this that I think would be both simpler and more secure than Vault's approach, but we haven't gotten to it yet.