Docs/Secrets/Quickstart

Getting Started with Secrets Vault

Store, encrypt, version, and inject environment variables and credentials with zero-knowledge AES-256-GCM envelope encryption. Set up your first vault project in under 3 minutes.

Projects & Stages

Isolate configurations across production, staging, preview, and local developer environments.

Envelope Encryption

Hardware-grade AES-256-GCM with versioned KEKs and zero-downtime rotation.

Native Injections

Inject into Docker, Kubernetes pods, CI/CD runners, and local developer shells with the CLI.

1. Authentication & Base URL

All Secrets API endpoints are mounted at /v1/secrets. The vault supports both user JWT authentication and high-entropy Service Account API keys:

Human / Web Console:

Platform JWT with tenant claim:

Authorization: Bearer <JWT_TOKEN>

Service Account / CI/CD:

Scoped API Key with Redis rate limiting:

Authorization: Bearer sa_live_83b92f...

2. Create Your First Encrypted Secret

Store an environment variable. The payload is encrypted with the active primary Key Encryption Key (KEK) using a unique 96-bit random nonce before writing to the database:

POST /v1/secrets/envs/{envId}/secretsAuth

Request

POST/v1/secrets/envs/{envId}/secrets

Response

3. Read & Decrypt Secret

Authorized callers with read scope retrieve and decrypt the value in real-time. Every access is logged to the immutable audit trail:

GET /v1/secrets/envs/{envId}/secrets/{name}Auth

Request

GET/v1/secrets/envs/{envId}/secrets/{name}

Response

Next Steps

Envelope Encryption Architecture→CLI Setup & Env Injection→