Secrets
Create, reveal, update, and delete workspace-scoped secrets with audited reveal.
Secrets stores sensitive values (API keys, connection strings, tokens) per workspace. The default backend is Infisical; dev environments without Infisical use an in-memory fallback.
Who can access
| Action | Required permission |
|---|---|
| List secrets (masked) | read |
| Reveal secret value | read (audited) |
| Create / update secret | write |
| Delete secret | delete |
Prerequisites
- Workspace selected in the top navigation picker
View secrets
Open Secrets
In the sidebar under Data, click Secrets.
Select a workspace
Use the workspace picker in the top navigation bar.
Browse the table
Secrets are listed by Key with masked values. Platform-managed secrets (e.g. DATAPLANE_SERVICE_API_KEY) are marked and cannot be edited or deleted from the portal.
Reveal a secret value
Click the eye icon on a row. The value appears briefly and the reveal is recorded in the audit log. Click again to hide.
Secret reveals are audited. Only reveal values when necessary and never share revealed values in chat or email.
Create or update a secret
Click New secret
Or click Edit on an existing row (non-platform secrets only).
Enter key and value
Keys are unique per workspace. Values are encrypted at rest by the secret backend.
Save
The secret appears in the table with a masked value.
Delete a secret
Click the trash icon, confirm in the dialog. Platform-managed secrets cannot be deleted from the portal.
Deep link from Dataplane setup
The Data Vault setup flow can link here with ?workspace_id={uuid} to jump directly to the correct workspace.
Troubleshooting
| Problem | Likely cause | What to do |
|---|---|---|
| Secret not found after create | Wrong workspace | Verify workspace picker |
| Cannot edit platform secret | Managed by Control Plane | Use Dataplane setup or API |
| Reveal returns empty | Backend not configured | Check Infisical in dev (deploy/PHASE2-DEPS.md) |
| 403 on upsert | Missing write | Check Members & Roles |
Related API
GET /v1/workspaces/{id}/secrets— list (masked)GET /v1/workspaces/{id}/secrets/{key}— reveal valuePUT /v1/workspaces/{id}/secrets/{key}— upsertDELETE /v1/workspaces/{id}/secrets/{key}— delete
See Shell Secrets for app integration.