The essentials · 30-second read
Doppler centralises secrets per environment. Developer plan: free for 3 users, then $8 a month per extra user. Team: $21 per user a month. Enterprise on quote.
- One place for secrets, organised by project and environment (development, staging, production).
- Developer: free for 3 users, then $8 a month per extra user. Team: $21 per user a month, with a 14-day trial.
- The CLI injects secrets at runtime (doppler run), so no .env file lies around on laptops.
- Our verdict: worth it as soon as more than one person or one environment touches your keys.
Summarize this page with AI
Doppler keeps the secrets of our own site: database URLs, storage tokens and API keys for each environment. Since we moved bebranded.xyz to Next.js and Payload in November 2026, every script we run goes through Doppler so that no key sits in a file on a laptop. This review covers what Doppler does, its 2026 pricing and when a simpler or heavier alternative fits better.
01What is Doppler?
Doppler is a secrets manager delivered as a service. Instead of scattering environment variables across .env files, hosting dashboards and chat messages, you store them once in Doppler, organised by project and environment. Apps, scripts and hosting platforms then read them from Doppler, through the CLI, the API or integrations.
Each project has environments (typically development, staging and production) and each environment has one or more configs: the actual set of key-value secrets. Access is controlled per person and per environment, and every change is logged.
02How we use Doppler at BeBranded
Our site has one Doppler project with one config per environment: dev for local work, stg for our staging site and prd for production. In daily use:
- Scripts run through
doppler run. When we migrate content, rewrite pages or check data, we start the command withdoppler run -p <project> -c stg -- .... The script gets the staging secrets as environment variables, and nothing is written to disk. - Switching environment is a flag. The same command with
-c prdtargets production, which makes the target explicit and visible in every command. - No
.envfile to pass around. A new machine needs the Doppler CLI and access, not a copied file.
It fits naturally with the rest of our stack: Next.js and Payload read standard environment variables, Vercel runs the deployments and GitHub holds the code but never the secrets. We set up the same discipline for clients in our web app, integrations and API and maintenance work, because leaked keys are one of the most common and most avoidable incidents.
03Key features
- Projects, environments and configs to organise secrets cleanly.
- Doppler CLI for local development and scripts (
doppler run). - Integrations and syncs to push secrets to hosting and cloud platforms.
- Access control per user and environment, with SAML SSO on Team.
- Activity log of every change (3 days on Developer, 90 days on Team).
- Secret rotation: automatic on Team, proxied rotation and dynamic secrets on Enterprise.
04Doppler pricing in 2026
Prices checked on doppler.com/pricing on 14 November 2026, in US dollars. The page shows monthly prices only, with no annual toggle.
| Plan | Price | |
|---|---|---|
| Developer | Free for 3 users, then $8/month per extra user | What you get Up to 25 users, 10 projects, 4 environments, 10 configs per environment, 5 config syncs, 3 days of activity log, CLI and integrations |
| Team | $21 per user/month (14-day free trial) | What you get 500 users, 250 projects, 15 environments, 100 configs per environment, 100 config syncs, 90 days of activity log, SAML SSO, automatic secret rotation |
| Enterprise | Custom | What you get Custom limits, unlimited config syncs, dynamic secrets, proxied rotation, enterprise SCIM |
Team add-ons cost $9 per seat per month each: custom roles, user groups, and integration syncs raised from 100 to 500.
Is Doppler free? Yes, for small teams. The Developer plan covers up to 3 users at no cost, with enough projects and environments for a typical site or app. Teams move to Team mainly for SSO, longer audit history and automatic rotation.
05Pros and cons
Advantages
- One source of truth for secrets across every environment.
- The doppler run pattern removes .env files from laptops and repositories.
- Clear separation between development, staging and production.
- Free for small teams, with a predictable per-user price after that.
- Activity log and access control make audits and offboarding simpler.
Drawbacks
- One more service in the stack, and one more account to manage.
- Scripts that fetch secrets at start-up depend on Doppler being reachable, so plan for that in your tooling.
- The Developer plan keeps only 3 days of activity log.
- SSO and rotation require the Team plan at $21 per user.
06Our verdict
Who it's for
- Development teams with several environments and several people touching keys.
- Agencies managing secrets for many client projects.
- Teams running scripts and migrations against staging and production.
- Companies preparing for security reviews that ask how secrets are handled.
Who it's not for
- A solo project with one environment, where the hosting platform's variables are enough.
- Teams on no-code platforms where secrets live inside the tool's own settings.
- Large infrastructure teams that need a self-hosted secrets platform: HashiCorp Vault fits better.
07Doppler alternatives
| Tool | Best for | |
|---|---|---|
| Doppler | Developer-friendly, managed secrets per environment | Model SaaS, free for 3 users |
| Hosting environment variables (Vercel and others) | Single app, single platform | Model Included with hosting |
| HashiCorp Vault | Large infrastructure, self-hosting | Model Open source or managed |
| Cloud secret managers (AWS, Google Cloud) | Teams already deep in one cloud | Model Pay per secret and request |
| 1Password or Infisical | Teams wanting secrets next to their password manager or open source | Model SaaS or self-hosted |
Our rule: hosting variables alone for a one-person, one-environment project; Doppler as soon as you have staging, production and more than one person; Vault or a cloud secret manager for infrastructure-heavy teams. Our article on what developers should deliver at launch explains why secrets handling belongs in the handover.
