The Secrets service, or Key Manager, stores sensitive values encrypted: passwords, API keys, encryption keys, and TLS certificates. It keeps secrets out of your code and config files, released only to the services that need them.
Store a secret
- Open the Secrets area of the console and create a secret.
- Fill in:
- Name: a clear label, such as
db-password. - Payload: the secret value itself.
- Secret Type (if asked): opaque for a general password or token; other types cover keys and certificates.
- Content type: usually
text/plainfor a simple value.
- Name: a clear label, such as
- Save it. It is encrypted at rest, so it is never written to disk in the clear.
Where secrets are used
- On their own, retrieved by name when a service or your team needs the value.
- Behind TLS certificates, where a certificate's private key is kept here.
- Behind encrypted volumes, where the encryption key is stored here rather than on the disk.
Treat retrieval like any sensitive action: give only the services and people that need a secret the access to read it.