Secrets

Secrets are environment variables that Fwoop stores encrypted and delivers to your services and jobs at start time. They’re part of the Team plan and above.

Environments

Each project has environments, production and staging by default. Every secret has a value per environment; values can fall back to a shared default.

Set and read secrets

$ fwoop secrets set STRIPE_SECRET --env production
Value: ••••••••••••••••••••
✓ Saved as v13 in production
$ fwoop secrets list --env production
DATABASE_URL   v13  used by api, worker
STRIPE_SECRET  v13  used by api
$ fwoop secrets import .env.staging --env staging

fwoop secrets get prints a value only if your role allows reading values.

Use them in services and jobs

Reference secrets the usual Compose way. Fwoop fills them in at deploy time:

services:
  api:
    image: ghcr.io/acme/api:1.42.0
    environment:
      DATABASE_URL: ${DATABASE_URL}

A service receives only the secrets it references, and only on the servers it runs on. The agent passes them to containers when they start and keeps them in memory; they’re never written to disk on your servers.

Versions

Every change creates a new version of the environment. Releases record the version they used, so rolling back a release restores its secrets too.

$ fwoop secrets diff production v12 v13
+ SENTRY_DSN
~ STRIPE_SECRET
- LEGACY_TOKEN

Changing a secret doesn’t restart anything. Fwoop shows which services still run an older version, and fwoop deploy rolls them.

Encryption

Values are encrypted with AES-256-GCM using a data key per environment, which is itself encrypted with your workspace key (envelope encryption). The control plane stores ciphertext; agents decrypt values only for the containers that need them.

Who can see what

With roles (Business and Enterprise), you decide who can read values and who can only use them in deploys. See teams and access.