Infisical vs OpenBao vs Doppler: secrets management for Next.js in 2026

Quick answer (2026)

If you are leaving HashiCorp Vault because of the licence, run OpenBao. It is the MPL-2.0 fork of the pre-BUSL Vault codebase, its migration guide replaces the Vault server process in place with every endpoint and URL unchanged, and it costs nothing. Accept in exchange that it publishes no Node SDK at all.

If you want a secrets platform with a real web UI, dynamic secrets and a first-class Node story, run Infisical. Read its meter first: it bills per identity, and on a Next.js deployment your identities are your CI runners, preview environments and background workers, not your teammates.

If your team is small and your machine count is large, Doppler is very likely the cheapest of the three, because it bills per human seat and says non-human identities ride free. It is also the only one of the three whose platform you cannot self-host.

Four things we found that the first page of Google does not say.

The licence everyone is fleeing now belongs to IBM, and it probably does not restrict you. We read LICENSE in the hashicorp/vault repository on August 22, 2026. The Business Source License parameters name the Licensor as International Business Machines Corporation (IBM), and the Licensed Work as "Vault Version 1.15.0 or later ... (c) 2024 IBM Corp." That is the paperwork of the IBM acquisition landing in the licence file, and it reads alarming. The honest reading is milder. The Additional Use Grant in that same file says you may make production use of Vault provided your use "does not include offering the Licensed Work to third parties on a hosted or embedded basis in order to compete with IBM Corp's paid version(s)." If you are running Vault to hold your own application's secrets, you are inside the grant. The licence is a genuine problem for a company reselling managed Vault. For a SaaS team self-hosting it behind their own app, it is mostly a governance objection, not a legal one. Choose on operations and cost, not on a licence clause that does not bind you.

The three tools bill in three different units, and that inverts the answer. Infisical bills per identity at $20/identity/month annually with five identities free. Doppler bills per human seat at $8/user/month on Developer with three users free, and states that non-human identities ride free. OpenBao bills nothing. A four-person team running twelve machine identities is therefore a near-free account on Doppler and a paid Pro conversation on Infisical, while a twenty-person team with three service identities is the exact opposite. None of the comparison pages we read put the two meters side by side, and the meter decides the answer more often than the feature list does.

The Node clients are the weakest part of all three stacks. We pulled the npm registry on August 22, 2026. Infisical's server shipped four releases in five days while its Node SDK has not been republished since April 2026. Doppler's Node SDK has been untouched since April 2024. The most-used Vault client for Node, node-vault at roughly 1.8 million downloads a month, is a community package that has never shipped a 1.0. And a deprecated Infisical client that last shipped in January 2024 still pulls around 111,000 installs a month.

OpenBao has no npm package, and that matters less than it looks. There is no openbao package on the registry at all, and its quick-start documents a Go client and raw HTTP with curl, nothing else. But its migration guide keeps every Vault endpoint and URL unchanged, so the HTTP API you already call does not move. You lose supported client code, not access.

How the three bill, and why the unit matters more than the number

Vendor pricing pages, read August 22, 2026.

An identity is not a person. On Infisical's meter, a machine identity is the thing you attach to a CI runner, a preview deployment, a worker or an agent, and it is the thing you are billed for. On Doppler's meter, the billable unit is a human seat, and Doppler's pricing page states plainly that AI agents and non-human identities ride free.

Put a shape to it. Take a four-person team running a Next.js app with a dozen machine identities across CI, preview environments and workers. On Doppler's Developer plan that is three free seats plus one at $8, and the twelve machines cost nothing. On Infisical's per-identity meter the free tier stops at five identities, so twelve machine identities is a paid Pro conversation at $20 each annually. Same team, same architecture, an order of magnitude apart, entirely because of which noun the vendor decided to count.

Now invert it. A twenty-person team with three long-lived service identities is the case where Doppler's seat meter is the expensive one and Infisical's is not.

We are deliberately not publishing a single total-cost number, because plan mechanics change and both vendors have enterprise tiers we cannot price. The durable point is the unit. Count the nouns in your own architecture before you read either price, because the cheaper tool is a property of your deployment shape, not of the vendor.

What the registry says about the Node clients

ShipGarden's usual test for whether a tool is real in a Next.js codebase is what the package registry looks like, not what the marketing page claims. All figures pulled from the npm registry and npm downloads API on August 22, 2026.

Four observations, and one of them is a genuine warning.

Infisical's server and its SDK are on completely different clocks. The Infisical/infisical repository shipped v0.162.20 through v0.162.24 between August 17 and August 21, 2026, which is four releases in five days. Its Node SDK has not been republished since April 23, 2026. The tempting reading is that the SDK is abandoned. The likelier and fairer reading is that Infisical is a continuously deployed platform whose server artifacts follow the SaaS train while the SDK is a thin, stable API client that genuinely does not need weekly changes. Either way, plan for it: if you self-host Infisical you are opting into a fast-moving server, and you should pin a version and schedule upgrades rather than tracking latest.

Roughly 111,000 downloads a month are still going to a package Infisical formally deprecated. infisical-node was last published in January 2024 and carries a deprecation flag, and it is still pulling six-figure monthly installs two and a half years later. If your project predates 2025, check which client you are actually importing before you evaluate anything else on this page.

Doppler's SDK is over two years stale while its CLI is not. @dopplerhq/node-sdk was last published April 8, 2024. The DopplerHQ/cli repository, by contrast, released 3.76.5 on August 14, 2026. That is not neglect so much as a statement of intent: Doppler is a CLI-first and inject-at-runtime product, and the idiomatic integration is to let the CLI populate the environment rather than to call an SDK from application code. If you were planning to import the Node SDK in a server action, you are swimming against the product's design.

The most-used Vault client for Node is a community package that has never shipped 1.0. node-vault pulls around 1.8 million downloads a month at version 0.12.0. It is not published by HashiCorp or IBM. The single most common way Node applications talk to Vault in 2026 is through a pre-1.0 third-party library, which is worth knowing before you describe Vault as the enterprise-grade option in a Next.js context.

OpenBao vs Vault: what the fork actually changed

OpenBao was created on November 9, 2023, a few months after the Vault licence change, and its LICENSE file is Mozilla Public License 2.0 carrying the line "Copyright (c) 2015 HashiCorp, Inc." That copyright line is the useful detail. It is the receipt showing this is a genuine fork of the MPL-era Vault codebase rather than a reimplementation, which is also why the compatibility story holds up.

OpenBao's in-place migration guide states that OpenBao replaces the Vault server process on all nodes and that "all configuration, including all endpoints and URLs will remain unchanged." For a Next.js team, that sentence is the whole integration answer. The absence of an openbao npm package is real, but it is not the wall it appears to be, because the HTTP API you were already calling does not move. What you lose is vendor-supported client code: OpenBao ships an official Go client and documents curl for everything else. If your Node service talks to it, you are writing fetch calls yourself or pointing a Vault-compatible community client at an OpenBao address, and neither route carries a support guarantee from the project.

Governance is the other real difference, and it is not marketing. OpenBao's security disclosures go to openbao-security@lists.openssf.org, placing it under the Open Source Security Foundation rather than a single vendor's inbox. If your objection to Vault was that a single company could change the terms again, that is the difference you are buying.

Scale honestly: hashicorp/vault has about 36,200 stars against OpenBao's 7,100 as of August 22, 2026. Vault also shipped a genuine 2.0 line this year, with v2.0.0 tagged April 14, 2026 and v2.0.4 on August 4, 2026, following the 1.21.x series. OpenBao is not the larger project and it is not standing still either, at v2.6.2 on August 18, 2026. But if you migrate, you are moving to the smaller ecosystem, and third-party integrations and tutorials will keep assuming Vault for some time.

Where each one actually fits a Next.js deployment

Choose OpenBao when the licence or the governance is the reason you are moving, when you already have people who can run a stateful clustered service, and when you can absorb writing your own HTTP client. Running OpenBao is running Vault, which means unseal key ceremonies, seal configuration, ideally auto-unseal against a cloud KMS, and a disaster recovery runbook you have actually tested. That operational bill is the price of the zero licence cost. It is a real bill.

Choose Infisical when you want a product rather than infrastructure: a UI your team will use, dynamic secrets, secret syncs, and an SDK that is genuinely maintained even if it is not busy. It is the strongest fit if your identity count is low or your budget tolerates a per-identity meter. Note the licence nuance if self-hosting matters to you: GitHub cannot classify the Infisical/infisical repository as a single licence, because content under any ee/ directory is governed by a separate commercial licence. The core is MIT and free to self-host, the enterprise directory is not, and "open source" is doing some work in that sentence.

Choose Doppler when your team is small, your machine identities are many, and you have no appetite for running secrets infrastructure. Its CLI-first injection model fits the way most Next.js apps already read configuration from the environment, and the seat meter with free non-human identities is straightforwardly the cheapest shape for a lean team with a wide deployment. The tradeoff is total: the platform is closed and hosted, so this is the option with no exit to self-hosting. Only the CLI is open source, under Apache-2.0, and at around 390 stars it is a small project by the standards of this comparison.

Stay on Vault if you are already running it, your use sits inside the Additional Use Grant, and nothing is actually broken. Migration is work, and "the licence changed owners" is not by itself a technical reason to spend a quarter on it.

Once you have picked one, the credentials it holds are mostly database credentials, so it is worth having settled which Postgres you are running first. And if the secret you are reaching for is a session or OAuth secret, the auth library comparison covers where those are better kept.

Where we would push back on ourselves

The per-identity versus per-seat contrast is the strongest finding on this page and it is also the one most likely to age. Vendors change meters, and both Infisical and Doppler have enterprise tiers whose terms are not public. Re-read both pricing pages before you commit; do not trust this table in six months.

We also have not load-tested any of these. Everything here is licence text, registry state, repository state and published pricing, all read on August 22, 2026 and all checkable by you in a few minutes. That is the class of claim we are willing to make. Throughput, latency under lease churn and real failover behaviour are a different article and would need us to actually run the three.