Data model
The entities any configuration is built from, and the words they are called everywhere: in the API, in the dashboard, and in this documentation.
Organization, project, environment
An organization is the boundary of billing and members. Inside it are
projects, inside projects are environments (dev, staging, production,
and any of your own — none are created by default). Entries live in an
environment: the same key name in different environments means different
values, and that is the normal, expected case.
Entry: variable or secret
There is one store, and visibility defines the behavior:
| Visibility | Who sees the value | When to use |
|---|---|---|
plain | everyone with access to the project | log level, external service URL |
masked | on explicit request, logged to the audit log | passwords, tokens, API keys |
restricted | identities only, humans — never | keys that people don't need at all |
A key name is [A-Z][A-Z0-9_]*, up to 128 characters. A variable (var)
must be plain; a secret — masked or restricted; a key's type and
visibility must match across all environments of a project.
An entry can have a lifetime (expiresAt): some time before it expires,
the server raises a secret.near-expiry event in the log and via a
webhook.
Versions and labels
Every value change creates a new version. Entry pointers show which version is what:
current— what consumers read;previous— the previous value, a rollback in one action;pending— a value already created by rotation but not yet applied (see rotation).
A rollback does not move pointers back; it publishes the old value as a new version: history stays monotonic, and you can see that a rollback happened at all.
Service and identity
A service is what you deploy: a worker, an API, a cron job. A container. A machine identity is the credentials of one service in one environment: a client ID, a login method, an access token TTL, and a scope — the project, the environment, and, if needed, a set of keys.
An identity has two issuance modes: universal (a permanent client secret)
and enrollment (a one-time enrollment token the service exchanges for
permanent credentials on its first start). Both are covered in detail on the
Services and identities page.
Roles
Two independent planes. The organization role (owner, admin, member)
manages projects and members, but does not by itself grant access to
secrets — that is the job of the project role (admin, member,
viewer). Everything is denied by default. An organization owner can grant
themselves a project role, but that is an explicit action, and it is
recorded in the log.