Secrets managers
Read secrets from an external secrets manager instead of storing values in Simplifyd Cloud.
By default, a service's variables are stored in Simplifyd Cloud, encrypted at rest. If your organisation already keeps secrets somewhere else, you can point a service at that system instead. Simplifyd Cloud then fetches the value when the service runs, and never stores it.
Use this when a secret has to stay in one system of record, or when rotating a secret centrally must take effect everywhere without editing each service.
Supported providers
| Provider |
|---|
| HashiCorp Vault |
| AWS Secrets Manager |
| Google Secret Manager |
| Azure Key Vault |
| Infisical |
| Doppler |
Connecting a provider
Connections belong to the workspace, so one connection serves every project in it. Only workspace owners can add or change them.
- Go to Project Settings → Secrets Managers.
- Click Add connection.
- Pick the provider and give the connection a name.
- Fill in the provider's settings — the address or account, and the authentication credentials.
- Click Save.
The credentials are encrypted at rest and are only decrypted when a service that uses them is deployed.
Using a secret in a service
- Open the service panel → Variables tab.
- Choose Add from secrets manager.
- Fill in:
| Field | Meaning |
|---|---|
| Connection | Which of the workspace's connections to read from |
| Environment variable | The variable name your application reads, e.g. STRIPE_SECRET_KEY |
| Remote key | The path or name of the secret in the provider |
| Property | Optional. If the secret is a JSON object, the field inside it to use |
| Version | Optional. Pin a specific version instead of taking the latest |
- Click Apply to deploy.
At runtime the variable holds the value from the provider. The value is never shown in the dashboard, the API, or the CLI — only the mapping is.
Rotating a secret
Change the value in the provider. Redeploy the services that use it to pick up the new value.
Removing a reference
Delete the entry from the Variables tab and apply. The variable stops being set on the next deployment; nothing changes in the provider.
If the connection cannot reach the provider or the key does not exist, the deployment fails rather than starting the service with a missing value. The service panel shows the error.
