Technology Stack
Relevant source files
The following files were used as context for generating this wiki page:
Barekey is a developer SaaS vault manager designed to manage encrypted environment variables (secrets) for developer teams. The architecture is built on a Backend-as-a-Service (BaaS) model, eliminating the need for a separate API server by leveraging Convex as the primary backend and database host.
The project follows a modern web application structure, utilizing a React-based Single Page Application (SPA) that communicates directly with the backend via WebSockets. It emphasizes high-tier developer experience (DX) through a clean, minimal UI and robust encryption standards.
Sources: AGENTS.md:3-6, AGENTS.md:16-19
Core Infrastructure
The infrastructure is primarily divided between a cloud-hosted backend and a high-performance frontend.
Backend and Database (Convex)
Convex serves as the unified backend layer, hosting the database, server-side functions, and authentication integration helpers. It manages data through defined schemas and provides real-time updates to the frontend via the ConvexReactClient.
Key features of the Convex implementation include:
- Functions: Public-facing
query,mutation, andactionhandlers. - Storage: File storage management via
ctx.storage. - Internal Logic: Private operations handled by
internalQueryandinternalMutation.
Sources: AGENTS.md:12-19, AGENTS.md:112-140
Frontend Framework
The frontend is a React SPA powered by Vite. It uses a component-based architecture with react-router-dom for client-side routing and navigation.
| Layer | Technology |
|---|---|
| Runtime | Node.js / Browser |
| Framework | React 19 |
| Build Tool | Vite 8 |
| Language | TypeScript |
| Routing | React Router Dom 7 |
Sources: pkg/ui/package.json:20-55, AGENTS.md:12-15
Authentication and Organization Management
Barekey delegates user identity and organization structures to Clerk. This integration ensures secure access control and facilitates multi-tenant workspace management.
Identity Flow
- Clerk: Handles Google, GitHub, and Passkey authentication.
- User Claims: Convex functions retrieve user identity using
ctx.auth.getUserIdentity(). - Workspace Isolation: Only organizations (teams) can own projects; individuals do not own projects directly.
Data Management and Storage
The data model is structured around Organizations, Projects, and Secrets, utilizing Convex's document-based storage.
Data Relationships
- Org: Managed by Clerk (not stored in Convex tables).
- Project: Belongs to an Org and acts as a container for variables.
- Project Variables: Scoped to specific project stages (e.g., development, production).
- Project Stages: Environment-specific containers (Development, Staging, Production).
Security and Encryption
Security is enforced through envelope encryption. Secrets are never stored in plaintext within the database.
Encryption Architecture
- Master KEK: Stored encrypted within the project document.
- Project DEK: Encrypted by the KEK and stored per project.
- Secret Value: Encrypted by the Project DEK.
UI and Styling Stack
The user interface emphasizes speed and clarity, utilizing a utility-first CSS approach and a modular component library.
- Styling: Tailwind CSS (v4) for layout and design.
- Components: Shadcn UI components built on top of Radix UI primitives.
- Icons: Tabler Icons (
@tabler/icons-react). - Feedback:
sonnerfor toast notifications. - Visualization:
rechartsfor usage metrics and data visualization.
Sources: pkg/ui/package.json:20-55, AGENTS.md:154-157, pkg/ui/src/pages/o/[org]/billing/page.tsx:85-110
Project Tooling
| Tool | Purpose |
|---|---|
| Convex CLI | Local development, deployment, and data inspection. |
| GitHub CLI (gh) | PR management and issue tracking. |
| agent-browser | Visual verification and UI automated testing. |
| Oxlint | High-performance linting for JavaScript/TypeScript. |
Sources: AGENTS.md:61-80, AGENTS.md:220-230, pkg/ui/package.json:8
The Barekey stack is designed for rapid development without compromising security, relying on managed services like Convex and Clerk to handle heavy backend and auth infrastructure.
Sources: AGENTS.md:7-10