Applications

Group one service’s Prod, Staging, and Dev projects while keeping secrets, machines, policies, and access separated by environment.

Updated today

Applications group the three projects used to run one service: Prod, Staging, and Dev. Create the application once, then manage secrets, machines, policies, and team access separately in each environment while keeping the service easy to find in the dashboard.

Creating an application creates all three environment projects together. Each project receives its own encryption key and keeps its own secrets, machines, policies, activity, and access settings.

#How applications organize your environments

An application gives one service a consistent place in the dashboard. Its three child projects provide the working boundaries for each environment.

Level	Purpose	What you manage there
Application	Groups one service and its environments	Application name, description, team scope, and the three environment projects
Prod	Runs the production environment	Production secrets, machines, policies, and access
Staging	Runs the pre-production environment	Staging secrets, machines, policies, and access
Dev	Runs the development environment	Development secrets, machines, policies, and access

The application appears as a folder in the sidebar. Expand it to open Prod, Staging, or Dev, then use the project links for Secrets, Policies, and Machines. The number beside the application shows how many of its projects are visible to you.

Application IDs begin with app_ and remain stable when you rename the application. Project IDs also remain unchanged, so existing machine and integration configuration continues to point to the same environment.

#Create an application

You need permission to manage projects in the vault.

Find Projects & Applications in the dashboard sidebar.

Select New application.

Enter a name between 1 and 100 characters.

Add an optional description that helps your team identify the service.

Review the three projects that will be created: Prod, Staging, and Dev.

Select Create Application.

After creation, the dashboard opens the new Prod project. The application and all three projects are available immediately in the sidebar.

Use the application name for the service or workload, such as Payments API or Customer Portal. The environment names are supplied automatically.

#Work in an environment

Expand the application in the sidebar.

Select Prod, Staging, or Dev.

Open Secrets, Policies, or Machines beneath the selected project.

Create and manage the resources required by that environment.

The selected project controls the context for each action. A secret created in Dev belongs to Dev, a machine added to Prod joins Prod, and a policy created in Staging applies within Staging. This keeps environment changes deliberate and easy to review.

Resource	Environment behavior
Secrets and versions	Stored and versioned in the selected project
Machines	Added to each project that the machine needs to use
Secret grants	Configured for a machine separately in each project
Access policies	Created and applied within the selected project
Project freeze	Affects only the selected environment project
Audit activity	Recorded with the project and application names for context

#Copy a new secret to other environments

After you create a standard or structured secret in an application project, the dashboard can offer to create it in the other available projects in the same application.

Create the secret in the environment where you are currently working.

At the copy prompt, review Prod, Staging, and Dev.

Select each additional project that should receive the secret.

Review any message showing that the same secret name already exists in a target project.

Select Confirm, or select Skip to keep the secret only in the current project.

Each selected project receives its own secret record, encrypted with that project’s key. Later edits, rotations, policies, machine grants, and deletion are handled separately for each copy. Frozen projects are left out of the copy choices.

For a generated rotating secret, each selected project creates and rotates its own generated value. Static values are copied as entered, then managed independently in each project.

#Control machine access by environment

Machine access follows the same project boundaries as secrets. Add a machine to every environment it needs, then grant the specific secrets it may read in each project.

A machine added to Dev does not automatically join Staging or Prod.
A secret grant in one environment does not grant the corresponding secret in another environment.
Removing a machine from one project removes its grants in that project while preserving its identity and access elsewhere.
Enrollment tokens can target the application, individual environment projects, or selected secrets according to the token configuration.

#Rename an application

Find the application in the sidebar.

Select the edit icon beside the application name.

Change the name or description.

Select Save.

Renaming changes the application’s display information. Prod, Staging, and Dev keep their names, IDs, resources, access settings, and encryption keys.

The three environment projects stay attached to the application throughout its lifetime. Their fixed names make the same environment structure recognizable across every application.

#Delete an application

Deleting an application permanently deletes all of its environment projects and their contents. This action cannot be undone.

Find the application in the sidebar.

Select the delete icon beside the application name.

Review the number of projects and the permanent-deletion warning.

Enter the exact application name.

Select Delete Application.

Deletion removes the application and every attached project in one operation, including secrets and version history, temporary secrets, rotation configuration, project machine memberships, and machine-to-secret grants. Active leased credentials are queued for cleanup. Registered machine identities remain in the vault, but they lose every membership and secret grant that belonged to the deleted projects.

An individual Prod, Staging, or Dev project is deleted with its application. The confirmation name must match the current application name exactly.

#Permissions and visibility

Access	Result
Vault owner	Can see every application and project and can manage application details
Manage projects permission	Can create, rename, and delete applications
Application in an access role	Member can see the application and the environment projects included by that role
Individual project in an access role	Member can see that environment under its application
Project excluded from an access role	That environment is hidden from members assigned to the role

For a member with limited scope, the application appears when at least one child project is available to them. Its project count reflects only the environments they can see. Capabilities assigned through the access role determine which secret, machine, and policy actions are available inside each visible project.

#Audit application activity

The Audit Log records application creation, updates, and deletion. Activity performed inside Prod, Staging, or Dev is recorded against the project, and the application name is included to make common environment names easier to identify.

Review who created, renamed, or deleted an application.
Filter project activity by application and environment context.
Use the application name in audit details to distinguish one Prod project from another.

#Troubleshoot applications

Symptom	What to check
Application is missing	Confirm that your access role includes the application or at least one of its projects.
Only one or two environments appear	Your access role may exclude a project or include only selected environments.
New application button is missing	Confirm that your vault role includes permission to manage projects.
Secret is missing from another environment	Create it there or use the copy prompt when creating a new secret. Existing copies are managed independently.
Machine cannot read the same secret in another environment	Add the machine to that project and grant the corresponding secret there.
Environment project cannot be renamed	Rename the application when its service label needs to change; Prod, Staging, and Dev keep their environment names.
Environment project cannot be deleted separately	Delete the application to remove all attached environment projects together.
Delete confirmation is unavailable	Enter the current application name exactly, including capitalization and spacing.