Standard Secrets
Store one encrypted value, grant it to machines, and manage replacement, rotation, policies, versions, deletion, and recovery.
Standard secrets store one encrypted value, such as an API key, password, token, connection string, or signing key. Create the secret in a project, grant it to the machines that need it, and manage replacement, rotation, policies, versions, and recovery from the dashboard.
A standard secret’s stored value is delivered only to an authenticated machine with an explicit grant. The dashboard lets members manage the secret without displaying its saved plaintext after creation.
#How standard secrets work
Every standard secret belongs to one project and receives a stable secret ID. Its name and note help people identify it, while machines and SDKs use the secret ID to request the value.
Part | Purpose |
|---|---|
Name | Human-readable label shown in the dashboard |
Secret ID | Stable identifier beginning with sk_ and followed by 16 letters and numbers |
Value | The encrypted single value returned to an authorized machine |
Note | Optional description of the secret’s purpose or owner |
Version | Number that increases whenever the value changes |
Machine grants | Explicit list of machines allowed to read the value |
Access policy | Optional rules evaluated before a granted machine receives the value |
Names can be changed without changing the secret ID. If several secrets have similar names, use the ID to select the intended secret reliably.
#Create a standard secret
Select the project that should own the secret.
Open Secrets.
Select the plus button and choose Secret.
Enter a name between 1 and 255 characters.
Enter a non-empty value of up to 12 KB.
Use the eye button when you need to reveal or mask the value you are entering.
Add an optional note.
Select Create Secret.
The secret is created as version 1 and appears in the project’s secrets table. Copy its ID when you need to configure a machine, SDK, command, or integration.
Use a name that describes the credential rather than its value, such as Stripe Production Key or CI Registry Token. Put ownership or usage context in the note.
#Create a generated rotating secret
You can enable rotation while creating a standard secret. In this flow, SikkerKey generates the first value and replaces it automatically on the cadence you choose.
Open the New secret form.
Enter the secret name.
Enable rotation.
Set the rotation interval.
Choose Random or UUID generation.
For a random value, choose a length from 8 to 128 characters and select uppercase letters, lowercase letters, digits, or symbols.
Add an optional note and create the secret.
Rotation intervals can range from 5 minutes to 30 days. The generated value is created by SikkerKey and stored as version 1. Each scheduled rotation creates the next version.
#Copy a new secret across an application
When the project belongs to an application, the creation flow can offer to copy the new secret to the application’s other available environment projects.
Create the secret in Prod, Staging, or Dev.
At the copy prompt, select the additional environment projects.
Review any warning that the same secret name already exists in a target project.
Select Confirm, or select Skip to keep it only in the current project.
Each target receives its own secret ID, encryption, versions, machine grants, policy, and lifecycle. A manually entered value is copied as entered. For a generated rotating secret, each project generates and rotates its own value. Frozen projects are not offered as copy targets.
#Import standard secrets from an .env file
Use Import .env when you need to create several standard secrets together. Each selected KEY=VALUE entry becomes a separate standard secret in the current project.
Open the project’s Secrets page and select Import .env.
Paste the file contents or upload a .env or text file.
Reveal or mask values while reviewing the input.
Select Continue.
Review the parsed names and values, then clear any entries you do not want to import.
Select Import.
Review how many entries succeeded or failed.
Blank lines and comments are ignored. A leading export keyword and matching single or double quotes around a value are removed during parsing. Uploaded files can be up to 1 MB, and each resulting secret value must still satisfy the 12 KB limit.
#Review standard secrets in a project
The secrets table gives you a project-level operational view without showing stored values.
Column | Meaning |
|---|---|
Name | Editable name and secret type |
ID | Stable secret ID with a copy button |
Note | Editable description |
Fields | Blank for a standard single-value secret |
Ver | Current version number |
Machines | Number of machines currently granted access |
Policy | Attached access policy, or no policy |
Updated | Most recent metadata or value change |
Last read | Most recent successful machine read, or Never |
Search by name, ID, or note. Sort by name, update time, or last-read time. Use the row menu to configure the value and rotation, open history, or move the secret to Trash.
#Rename a secret or update its note
Select the name or note directly in the secrets table.
Enter the replacement text.
Press Enter or move focus away to save.
Name and note changes update metadata only. The secret keeps the same ID, value, version, grants, policy, and project. Renames and note changes are recorded in the Audit Log.
#Replace the value
Open the secret’s row menu and select Configure.
Open Value.
Enter the replacement value.
Use the eye button to reveal or mask the value you are entering.
Select Replace value.
Replacing the value encrypts it with a new secret-specific key and creates the next version. The secret ID, name, note, machine grants, and policy remain unchanged, so authorized machines receive the replacement on their next read.
The dashboard does not fill the form with the current plaintext. Enter the complete replacement value you want the secret to use.
#Rotate the value
Rotate once
Use Rotate in the Configure panel to generate a new value immediately. Choose Random or UUID, configure the value shape, and select Rotate now. The generated value becomes the next version.
Enable and manage a schedule
Open Schedule to add automatic rotation to an existing standard secret. Choose the cadence and generated-value shape, then select Enable rotation. Once enabled, the panel shows whether rotation is active or paused, the most recent rotation, and the next scheduled rotation.
Use Save schedule after changing the interval or generated-value shape.
Use Pause rotation to stop scheduled changes while keeping the schedule configuration.
Use Resume rotation to continue from a paused schedule.
Manage value changes through the rotation schedule while the secret has scheduled rotation.
#Review and restore versions
Version history contains the creation version and every value produced by replacement, manual rotation, scheduled rotation, or restoration. It shows version numbers and timestamps without revealing the stored values.
Open the secret’s row menu and select History.
Open Versions.
Find the earlier version you want to use.
Select Restore.
Restoring an earlier version preserves the existing timeline. SikkerKey copies the selected encrypted value into a new current version instead of deleting newer history. For example, restoring version 2 while version 8 is current creates version 9.
Version restoration is available for standard secrets without a rotation schedule. Scheduled secrets continue through their configured rotation lifecycle.
#Grant a machine access
A machine must be approved, added to the project, and explicitly granted the standard secret before it can read the value.
Open Machines beneath the project.
Add the approved machine to the project if it is not already present.
Open the machine’s row menu and select Configure.
Select the standard secret from the available list.
Save the grants.
The grant takes effect immediately. Removing the secret from the machine’s grants, removing the machine from the project, disabling the machine, freezing the project, or deleting the secret stops access.
When an authenticated machine requests the secret, SikkerKey verifies its identity, current project membership, explicit grant, project status, vault status, and any attached policy before decrypting and returning the value. Successful, denied, and policy-blocked requests are recorded in the Audit Log.
#Attach an access policy
Use the Policy column to attach one policy from the current project. The policy is evaluated on every machine read before the value is disclosed.
Time windows limit reads to selected days and hours.
Source-address rules restrict where requests may come from.
Rate limits cap reads per minute or day.
Co-signing requires recent access by a designated machine.
Lifetime rules can move the secret to Trash after a time or read limit.
Read-count rotation can generate a new version after a configured number of reads.
Select No policy to remove the binding. You can also select multiple secrets and apply or remove a policy in bulk. Each secret can have one attached policy at a time.
#Delete and restore a standard secret
Deleting a standard secret moves it to Trash for 30 days. It becomes unavailable immediately, and all machine grants and rotation settings are removed.
Open the secret’s row menu and select Delete, or select several rows for bulk deletion.
Review the affected secrets and the number of machines that will lose access.
Confirm the deletion.
During the recovery window, the encrypted value, ID, name, project, and version history remain available for restoration. Restore the secret from Trash, then reapply its machine grants and any required rotation settings. The original project must still exist.
Permanent deletion from Trash, or automatic cleanup after 30 days, removes the secret and all retained versions. That action cannot be undone from Trash.
#Permissions
Permission | Access provided |
|---|---|
Project in scope | View standard-secret metadata, versions, machine count, policy, and activity |
Manage normal secrets | Create, rename, update, rotate, restore versions, and delete standard secrets in the scoped project |
Configure machine grants | Choose which project secrets a machine can read |
Manage policies | Attach, remove, and configure access policies according to the role’s policy capabilities |
Manage own Trash | Restore or permanently delete secrets the member deleted |
Manage all Trash | Manage every deleted secret in the vault |
Vault owners receive full access. Organization members receive project scope and management capabilities through their access role, while Trash permissions come from their vault role.
#Audit standard-secret activity
Open History and select Audit to review activity for one secret, or use the vault Audit Log for a broader investigation.
Creation, rename, note update, value replacement, rotation, and version restoration
Rotation schedule creation and changes
Policy attachment and removal
Successful machine reads, denied reads, and policy-blocked reads
Deletion, restoration, permanent deletion, and retention cleanup
#Troubleshoot standard secrets
Symptom | What to check |
|---|---|
Secret creation is unavailable | Confirm the project is in your access-role scope and Manage normal secrets is enabled. |
Value is rejected | Confirm it is not empty and does not exceed 12 KB. |
Stored value cannot be revealed in the dashboard | Use an authorized machine or SDK to read it, or replace it with the intended value. |
Machine receives Access denied | Confirm the machine is approved, belongs to the project, and has an explicit grant for this secret. |
Machine read is blocked | Review the attached policy, project freeze status, source address, time window, rate limit, and co-sign requirement. |
Replace, manual rotation, or version restore fails | Check whether the secret has a rotation schedule and manage its value through that schedule. |
Secret disappeared after deletion | Open Trash and restore it within 30 days, then reapply machine grants and rotation settings. |
Application environment has an outdated value | Update that environment’s separate secret; copied application secrets are managed independently after creation. |