Faster secret reads, and a status page that tells the truth

I built a small test app that loads its secrets from Nionx when it starts. It printed this:

Loaded 3 secret(s) from Nionx in 408 ms

408 milliseconds to get three secrets. That felt slow, so I spent a day finding out where every millisecond went. Reading secrets is now several times faster, without giving up a single security check, and there's a public status page so you can watch the numbers yourself.

Where the time went

Every time an app read its secrets, the API made five separate trips to the database, one after another:

• Look up the token.
• Count the request against the per-minute limit.
• Count it against the monthly plan limit.
• Read the encrypted values.
• Write the audit log entry.

Each trip costs about 25 ms. Five of them add up to about 125 ms, more than half of the whole request, before anything is even decrypted.

Five trips became one

The database can run several statements as one transaction, in one trip. So now a single transaction looks up the token, reads the encrypted values, counts both limits and writes the audit entry, with every condition written into the transaction itself:

• The writes only happen if the token is valid, not revoked and not expired.
• The audit entry is only written if the request is within both limits.
• If anything fails, the whole transaction fails and nothing is returned. A read can never happen without being logged.

Tokens with an IP allowlist take one extra trip, because checking the address has to happen in code first. Everything else is one trip.

Waking up faster

The second problem was cold starts. When a request lands on a Cloudflare server that hasn't run our code for a while, that server first has to load and start it. Our API carried everything: sign-in, the dashboard API, the connection for AI agents. 4.3 MB of code, all loaded just to read a secret.

Now reading secrets has its own small fast lane. It loads 173 KB instead of 4.3 MB, and the rest only loads when something else is asked for. The start-up time Cloudflare reports went from 39 ms to 9 ms. A test checks that the fast lane answers exactly like the full API, down to every security header.

What I didn't do

Some of the easiest speed-ups would have cost security, so I left them out:

• Caching tokens. A token you revoke would keep working until the cache expired. Revoking has to be instant.
• Database copies closer to you. A copy can lag a moment behind, and in that moment a revoked token could still read secrets.
• Logging reads after answering. That saves about 30 ms, but if saving the log entry failed, a read would go unrecorded. Every read is logged, always.

The numbers

Measured from Sweden, with a real token:

• App with an open connection (a running server): about 235 ms before, about 60 ms now.
• Brand-new process (like my test app at start-up): about 150 ms now. Around 100 ms of that is Node.js starting up, the DNS lookup and setting up an encrypted connection, which every HTTPS call pays the first time, to any service.

A status page that tells the truth

You shouldn't have to take my word for any of this, so there's now a public status page: status.nionx.cloud. Every two minutes it checks the website, the dashboard, the API, secret reads, the AI agent connection, sign-in and the database. It shows uptime for the last 90 days, opens and closes incidents by itself, and runs on its own database, so it keeps working even if the product's database doesn't.

My first version showed numbers like 4 ms for the API. That's real, but it's only the server's own time, measured from inside Cloudflare right next to our servers. Your app doesn't get 4 ms, because it first has to reach Cloudflare. So the page now shows two things:

• From your location: your own browser times the API while you watch: the first request including connecting, then on the open connection. That's what an app on your network gets.
• Server time: how fast each service answers, measured from inside Cloudflare. Add the two together and you have your real number.

Distance still matters

One more honest thing. Our database lives in one place, in Eastern Europe. Cloudflare runs our code close to your app, but every read still travels to that one database. From Europe a read takes around 60 to 100 ms. From the US it's more like 150 to 200 ms, and from Asia more than that.

For how apps actually use secrets, loading them once at start-up, that rarely matters. Still, two things are now on the roadmap:

• Secrets cached in your app. The CLI and SDK will keep secrets in memory and refresh them in the background, so reads after the first take no time at all.
• Fast reads worldwide. Database copies in the US and Asia, with revoked tokens still checked against the main database, so revoking stays instant.

If you're testing Nionx, open the status page and press “Measure again”. Then tell me what you see from where you are.

Benji