Secryn updates are delivered through the Self-Host Pro Docker registry. To pull updated images manually, you need a Docker access token from your Self-Host Pro product dashboard.

Updates and Your Subscription

The $99 USD/year subscription per organization includes product updates made available during the active paid term and standard email support during that term. Annual renewal buys continuing updates and standard email support.

You can cancel at any time. Updates and standard email support continue until the end of your paid term, then end if you do not renew. Cancellation or expiry does not revoke your license to use your installed version: you can keep using your licensed installed version forever, subject to the license terms. A refund is available for 7 days after purchase.

When You Need an Access Token

The install script handles authentication automatically during the initial setup. You only need to create an access token yourself if you want to:

• pull Secryn updates manually with Docker
• set up automated image updates on your server
• authenticate from a different Docker client or host

Create an Access Token

1. Go to app.selfhostpro.com/my-products
2. Sign in with the email used for your purchase
3. Open Secryn
4. Click Create Access Token
5. Copy the credentials shown on screen

You will receive:

• Username - your email address
• Token - the Docker registry password

The token is only shown once, so store it securely.

Log In to the Registry

Use your token to authenticate Docker against the Self-Host Pro registry:

docker login shpcr.io -u [email protected] -p your-token

To avoid storing the token in shell history, use stdin instead:

echo "your-token" | docker login shpcr.io -u [email protected] --password-stdin

Update Secryn

From the installation directory, pull the images the stack uses, then restart:

cd /srv/secryn
docker compose pull
docker compose up -d

docker compose pull pulls exactly what the stack uses, including the schedule and queue containers, whatever SELFHOST_PRO_VERSION is set to.

Upgrade note: encrypt existing private keys

Current releases store generated private keys, uploaded private keys, and certificate private keys in a SECRYN-PRIVATE-V1 envelope encrypted with APP_KEY. New files are written that way. An existing install still has the older plaintext files until you run the encryption command. Secryn has not completed a third-party audit or penetration test.

Do this after the new containers are running:

1. Copy APP_KEY from /srv/secryn/.env and store that copy outside the server, separate from your backups. If that key is lost, private keys that are still only stored in a SECRYN-PRIVATE-V1 envelope cannot be recovered. The same key is also required to read existing secret values.
2. Preview the migration inside the Secryn application container:

php artisan vault:encrypt-private-material --dry-run

3. Run it after the preview looks right:

php artisan vault:encrypt-private-material

4. Rotate any private key whose public link was ever enabled before this release, including a certificate private key. Older public links could serve private key material. A public link now returns only public material, and it never returns a private key. Anyone who used the old link may still have that private key.

A backup taken on this release does not keep private-key files as SECRYN-PRIVATE-V1 envelopes inside the archive. Secryn unwraps those envelopes at backup time and stores plain PEM/OpenSSH data. The backup key or passphrase protects that copy, and restore seals the private keys again with the restoring instance's APP_KEY. Secret values in the database dump stay encrypted with the original APP_KEY (or the same key listed in APP_PREVIOUS_KEYS). So does any private-key envelope Secryn could not decrypt when the backup was taken.

Manage Tokens

From the Secryn product page in Self-Host Pro, you can manage existing access tokens.

Regenerate a Token

Regenerating creates a new token and immediately invalidates the old one.

1. Open Secryn in Self-Host Pro
2. Find the access token you want to replace
3. Click the three-dot menu
4. Select Regenerate
5. Copy the new token

Delete a Token

Deleting permanently removes the token. You will need to create a new one before Docker can authenticate again.

1. Open Secryn in Self-Host Pro
2. Find the access token you want to remove
3. Click the three-dot menu
4. Select Delete

Token Security

• access tokens grant pull access to all products tied to your account
• store tokens securely and never commit them to version control
• regenerate tokens immediately if you suspect exposure
• review the last-used timestamp in the dashboard to spot unused or unexpected tokens