Store API keys and environment variables in Secrets

The Secrets tab in Vault is for keys that software uses, such as API keys and environment variables. People's own logins belong in Passwords. See PGB Vault.

Know the difference: secrets are encrypted one by one, but the key that protects them is held by the PGB Business server. They are not zero-knowledge like personal passwords.

Create a project

1. Open Vault and choose Secrets.
2. Choose New project.
3. Enter a Project name, for example Website or Billing API, and choose Create. You become its admin.

Add a secret

Each project has an environment tab: Development, Staging or Production.

1. Pick an environment, then choose Add secret.
2. Name: letters, digits and underscores, not starting with a digit, like STRIPE_API_KEY.
3. Value: the secret itself, up to 64 KB.
4. Optionally set Rotation days (1 to 3650). The secret is flagged Due for rotation when that time passes.
5. Choose Save.

To change one, open it and enter a New value (leave empty to keep the current one). Each secret keeps its last 20 values; revealing an old one is logged too.

Reveal, copy and hide

Values stay hidden. Choose reveal to see one: it hides again after 30 seconds. Copy puts it on your clipboard. On the phone app, you confirm it is you before a value shows, and the clipboard is cleared after 60 seconds.

Import and export

• Import .env takes a file or pasted text. Lines like API_KEY=value become secrets.
• Export downloads one environment as a .env file. Delete the file when you are done with it.

Who can do what

Under Members or Project members, add colleagues by address and give each a role:

• Viewers can see and copy values.
• Editors can also change, import and export them.
• Admins manage members and service tokens.

Workspace administrators are admins of every project.

Service tokens

For CI or a server that needs the values, choose Service tokens, type a Name (for example GitHub Actions), pick one environment, and create it. Copy the token straight away: it is shown once. A token can only read one environment as a .env file. It cannot change anything, and every read is logged. Choose Revoke if it leaks, and anything using it loses access at once.

Access log

The Access log records every reveal, export and token read for the project. Administrators can open it after an incident.

Good to know

• Never paste a key into chat, a document or an email.
• Rotate keys on a schedule, and use the rotation reminders.
• Give people the least access they need.
• Deleting a project deletes all its secrets, versions and tokens for everyone, and cannot be undone.