Vaults and environments

Choose a vault boundary

A vault is a named collection of environments for an application or related workload. Use a separate vault when its configuration should be selected independently—for example orders-api and reporting-worker.

Owners and admins can create, edit, and delete vaults and environments from the dashboard. Members can work with secret values in existing environments but cannot manage those containers. See access and tokens.

Creating a vault adds Development, Staging, and Production. Add other environments from the vault workspace when needed. Names are display labels; slugs are the identifiers used by the CLI. If a slug changes, update affected local configuration and automation targets.

Add or import values

Open an environment to add a key, value, and optional description. The table keeps values hidden until you explicitly reveal or copy one. Current and historical reveal/copy operations are recorded in Audit.

Use the environment import workflow or outray secrets import --from .env.local to add dotenv values. The CLI import updates supplied keys and leaves other keys in place. Each value is limited to 64 KiB; imported values are limited to 1 MiB in total.

Do not use a production credential to make a development example work. Identical key names across environments do not imply identical values, inheritance, or synchronization.

Move selected secrets

Select keys in an environment and use the bulk Move action. Choose the destination environment and review how conflicting key names should be handled. Confirm any operation affecting a protected production environment.

A move is a mutation, not an ongoing sync between environments. Review services that read both source and destination before moving a key. A share link is different: it stores a snapshot and does not move the source.

Production protection

The dashboard stores a production-protection flag on the environment. Protected changes, imports, exports, and shares require the relevant confirmation. The CLI also requires --confirm-production for value access or mutations when the target slug is prod or production; the server can require confirmation for other environments marked as production too.

If a custom protected environment prompts for confirmation, supply the flag even if its slug is not literally production. Do not treat the flag as additional authorization: the caller still needs the appropriate role or token scope.

Delete and recover carefully

Deleting a vault or environment removes its contained values from normal access and records a deletion batch in Trash. Review the affected item count and production warning first. Restore is an owner/admin dashboard operation, not a runtime token permission.