Vault
Every secret, setting and certificate your project's apps read, in one list, with who uses each.
On this page
What it is
The Vault is one list per project of the values your apps read: secrets such as passwords, API keys and tokens, settings such as a log level, and certificates. Each entry shows which apps, scheduled jobs and domains use it, and under which name.
Shared entries belong to the project. An app's own values appear here too, under the app's name, and you change them on the app's Configuration tab.
When you'd use it
- An API key two apps need, added once.
- Knowing which apps read a key before you rotate or delete it.
- Moving a project over with a
.envfile to bring along.
Add a secret or a setting
- Open the project and go to Vault.
- Choose Add, pick Secret or Setting, and give it a name. Names are uppercase with underscores, the shape environment variables take.
- Paste the value, or choose Generate one for a random 32-character secret.
- Tick the apps that should read it, and choose Add and restart.
Adding and changing shared entries needs the admin role in the project. Editors choose which apps read an entry.
Import a .env file
- Choose Import .env and paste the file.
- Check the kind of each line. A name that looks sensitive starts out as a secret; switch any that are not.
- Choose Import. Nothing is stored before that.
See a secret's value
Choose Reveal next to a hidden value. Editors and admins can, from a signed-in session; an API token cannot. Each reveal shows in the project's activity, and each person can reveal 30 values an hour. The value hides again when you choose Hide or leave the page.
The CLI does the same with klops vault reveal STRIPE_SECRET_KEY.
Settings reference
| Setting | Default | What it does |
|---|---|---|
| Kind | Secret | A secret is stored encrypted and shown only on Reveal. A setting is shown as it is. |
| Name | none | The environment variable name, unique in the project. |
| Value | none | Pasted, or generated for a secret. |
| Use it in | none | The apps that read it. Changing it restarts them. |
Limits and gotchas
- Changing a value restarts what reads it. A container reads its environment at start.
- Database credentials are not entries. A database hands its connection details to an app as a binding, which rotates with the password.
- A domain picks its certificate in its HTTPS section. Here you see each certificate's state and replace an uploaded one with its renewal.
- Only what klickops created is listed. A value an app reads from a Secret created elsewhere shows on that app's Configuration tab.