Stack vs Doppler

TL;DR

Compare Doppler against the credential workflow your team needs. Stack coordinates supported provider setup and records configuration and slot names; managed credentials use Phantom. Four adapters have resource-creation paths, while others attach or accept credentials. Verify current Doppler capabilities directly; this page is not a vendor security, pricing or feature audit.

When to pick each

Pick Doppler when	Pick Stack (+ Phantom) when
Your team already standardized on Doppler and has dev/staging/prod workflows in place.	You're starting fresh and want secret storage tied to provisioning, not as a separate step.
Verify current audit, access-control and compliance features.	You want managed Phantom slots with separately qualified storage behavior.
Check current SDK support for your runtime.	You want stack add stripe to accept an existing credential and attempt configuration.

Evaluate the actual credential-storage, access-control and provider setup requirements. Stack’s sequential writes do not establish an atomic transaction or a blanket no-plaintext guarantee.

At-a-glance

Capability	Stack (+ Phantom)	Doppler
Category	Provider setup with Phantom credential integration.	Check current product scope.
Primary surface	Stack CLI, MCP and plugin; Phantom CLI is a separate prerequisite.	Check current supported interfaces.
Vault model	Uses the installed Phantom credential interface.	Check current storage and sync contracts.
Encryption	Requires installed-product storage and access qualification.	Verify current encryption and access guarantees.
Runtime injection	stack exec -- bun dev forwards to phantom exec; Stack does not resolve placeholders.	Check the supported runtime-delivery interface.
Provisioning	39 source catalog entries; four create-resource adapters, others attach or accept credentials; sequential writes.	Check current provider integration support.
Team sharing	Requires separately qualified installed sharing controls.	Check current roles, permissions and environment support.
Audit logs	No audit guarantee established by this source.	Verify current audit and retention behavior.
License / pricing	MIT source; public npm 0.1.1 and source 0.2.1 are distinct; no future pricing guarantee.	Check current pricing and limits.
Best for	Solo devs, startups, agentic workflows, composed SaaS setups	Evaluate against your team’s credential and access requirements.

Where they overlap

stack exec -- forwards to phantom exec --. Stack does not itself expand placeholders or build a filled environment file. Qualify the installed execution and credential interface separately; this source does not establish equivalent behavior in another product.

Storage, export, backup and runtime access have separate security boundaries. Verify the installed products and your configuration rather than inferring vendor access or encryption guarantees from this comparison.

Where Stack wins

• Provider-specific setup. stack add stripe accepts an existing Stripe credential and attempts Phantom storage and configuration writes. It does not create an account, and later failure can leave partial state.
• Managed credential slots. Stack uses Phantom’s installed interface for credential persistence. Qualify its storage and runtime behavior; Stack source does not establish a universal encryption or vendor-access guarantee.
• Explicit environment configuration. Stack can export a KEY= skeleton to .env.example. It does not generate a filled .env.local, resolve phm_* tokens or make project files safe to commit.
• MCP control plane. Reviewed source declares 19 tools and conditional raw-file resources. The server forwards CLI output as text; inspect the installed client’s actual capabilities and project directory.
• Source license. Stack source is MIT. This does not establish future service pricing or another vendor’s current terms.

Where Doppler wins

Requirements to check against current Doppler documentation:

• Team access requirements. Check current roles, permissions, environments and sharing behavior against your needs. This source comparison does not qualify those controls for either installed product.
• Audit and compliance requirements. Verify current certifications, retention and access records directly with the vendor. A source roadmap is not an implemented audit guarantee.
• Runtime integration requirements. Check SDK and process-execution contracts against your application. Stack’s phantom exec forwarding alone does not prove supported runtime secret delivery.
• Existing workflows. Preserve a working setup while evaluating change. Provider setup with stack add does not automatically transfer secrets to another vault.
• Support requirements. Check current support terms and installed-version behavior. Source 0.2.1, recorded public npm 0.1.1 and historical native 0.2.0 are distinct.

Can I use both?

If you keep an existing vault workflow, qualify any transfer separately. stack add supabase can create a project and persist credentials through Phantom, but this source does not implement a Doppler pipe or an automatic phantom sync bridge. Inspect partial state and permissions before attempting a migration.

Migration and caveats

This page describes reviewed source 0.2.1. Recorded public npm 0.1.1 and historical native release 0.2.0 are separate artifacts. Team controls and runtime credential delivery require installed-product qualification. See /docs/phantom, /docs/mcp and /docs/providers for the source-defined workflows.

FAQ

Is Stack a secret manager?

Stack coordinates supported provider setup and records configuration and credential slot names. Managed credentials use Phantom. Resource creation is adapter-specific and writes are sequential, not an atomic transaction. This source does not establish a native Doppler credential bridge.

Can I migrate from Doppler to Phantom?

A migration requires separately qualified export, import, backup and access-control procedures for the installed products. This Stack source does not establish a Doppler import or phantom sync command.

Which do YC startups use?

No startup adoption evidence is established here. Compare your team’s supported credential, provider setup and access-control requirements against current product documentation.