Secrets
Secrets and env vars, without the .env files.
Keep every environment variable in one place, versioned and encrypted. Fwoop sends each secret only to the servers that need it and records every change.
The production environment's secrets with masked values and the services that use them, next to a diff from version 12 to version 13 that adds SENTRY_DSN, changes STRIPE_SECRET and removes LEGACY_TOKEN. The new version is synced to four servers and two services still need a redeploy.
How it works
The life of a secret.
Readable in exactly two places: by you, and inside the container that needs it.
- 01
You set it
In the dashboard, from the CLI or by importing a .env file.
- 02
It's sealed
Encrypted with your workspace key before it's stored. The control plane keeps ciphertext.
- 03
It's delivered
Only to agents on servers running a service that references it, over their TLS connection.
- 04
It's injected
As an environment variable when the container starts. In memory, never written to disk.
Access
Use a secret without seeing it.
Developers can ship with production credentials they can't read. Roles are part of Business and Enterprise.
| Permission | Owner | Admin | Developer | Viewer |
|---|---|---|---|---|
| See secret names | Yes | Yes | Yes | Yes |
| Use secrets in deploys | Yes | Yes | Yes | No |
| Read values | Yes | Yes | No | No |
| Create and change values | Yes | Yes | Staging only | No |
| Delete secrets | Yes | Yes | No | No |
| Manage environments and access | Yes | No | No | No |
Versions
Every change is a version, every release pins one.
A deploy records the secrets version it used. Roll back a release and its secrets come back with it, so a bad credential change is as easy to undo as bad code.
$ fwoop secrets set STRIPE_SECRET --env production
Value: ••••••••••••••••••••
✓ Saved as v13 in production
$ fwoop secrets diff production v12 v13
+ SENTRY_DSN
~ STRIPE_SECRET
- LEGACY_TOKEN
Used by: api, worker. Redeploy them? [Y/n] y
✓ api and worker are rolling out with v13Questions about secrets
Are secrets written to disk on my servers?
No. The agent passes them to containers as environment variables when they start and keeps them in memory, not in files.
What happens to running services when I change a secret?
Nothing, until you redeploy. Fwoop shows which services still run the old version and can roll them for you.
Can Fwoop staff read my secrets?
No. Secrets are decrypted only by your agents. Support access to a workspace needs your explicit, time-limited approval, and it's logged.
Can I import my existing .env files?
Yes. Upload or paste a .env file per environment. Fwoop shows what will be added or changed before it saves.
Bring your first server online in five minutes.
Start free with three servers. No credit card, no sales call, and your workloads stay on machines you own.