> ## Documentation index
> The full klickops handbook index is at https://klickops.io/en/llms.txt
> The HTML of this page is at https://klickops.io/en/docs/vault
> Language: en

# Vault

Every secret, setting and certificate your project's apps read, in one list, with who uses each.

## What it is

The Vault is one list per project of the values your apps read: secrets such as passwords, API keys and tokens, settings such as a log level, and certificates. Each entry shows which apps, scheduled jobs and domains use it, and under which name.

Shared entries belong to the project. An app's own values appear here too, under the app's name, and you change them on the app's **Configuration** tab.

## When you'd use it

- An API key two apps need, added once.
- Knowing which apps read a key before you rotate or delete it.
- Moving a project over with a `.env` file to bring along.

## Add a secret or a setting

1. Open the project and go to **Vault**.
2. Choose **Add**, pick **Secret** or **Setting**, and give it a name. Names are uppercase with underscores, the shape environment variables take.
3. Paste the value, or choose **Generate one** for a random 32-character secret.
4. Tick the apps that should read it, and choose **Add and restart**.

Adding and changing shared entries needs the admin role in the project. Editors choose which apps read an entry.

## Import a .env file

1. Choose **Import .env** and paste the file.
2. Check the kind of each line. A name that looks sensitive starts out as a secret; switch any that are not.
3. Choose **Import**. Nothing is stored before that.

## See a secret's value

Choose **Reveal** next to a hidden value. Editors and admins can, from a signed-in session; an API token cannot. Each reveal shows in the project's activity, and each person can reveal 30 values an hour. The value hides again when you choose **Hide** or leave the page.

The CLI does the same with `klops vault reveal STRIPE_SECRET_KEY`.

## Settings reference

| Setting | Default | What it does |
| --- | --- | --- |
| Kind | Secret | A secret is stored encrypted and shown only on Reveal. A setting is shown as it is. |
| Name | none | The environment variable name, unique in the project. |
| Value | none | Pasted, or generated for a secret. |
| Use it in | none | The apps that read it. Changing it restarts them. |

## Limits and gotchas

- **Changing a value restarts what reads it.** A container reads its environment at start.
- **Database credentials are not entries.** A database hands its connection details to an app as a binding, which rotates with the password.
- **A domain picks its certificate in its HTTPS section.** Here you see each certificate's state and replace an uploaded one with its renewal.
- **Only what klickops created is listed.** A value an app reads from a Secret created elsewhere shows on that app's **Configuration** tab.

## Related

- [Domains](/en/docs/domains) serve the certificates.
- [Apps](/en/docs/apps) read the vault as environment variables.