Search

Secrets Manager setup guide

For IT administrators setting up Secrets Manager for their organisation.

Secrets Manager is where your organisation keeps the secrets your systems use, as opposed to the passwords your people use: database passwords, API tokens, connection strings, certificates and SSH keys. You add and manage them in the Admin Portal. Your servers, pipelines and Kubernetes clusters read them with an API key you issue and can revoke.

Secret values, descriptions and tags are encrypted with a key that belongs to your organisation. Uniqkey stores only the encrypted result and cannot read them.

Before you start

You need:

  • An administrator account in the Admin Portal. Support accounts cannot open Secrets Manager, and employees never see it.
  • The Uniqkey app on your phone, signed in to the same account. Secrets Manager unlocks through Trusted Portal, so you approve on your phone.
  • Trusted Portal allowed for your organisation, under Security and access → Baseline security.
  • A plan for your paths. Ten minutes on Plan your paths now saves a migration later.

If machines will read secrets, decide who owns each API key and where it will be stored. An API key is a credential in its own right.

Unlock it for the first time

There is no key for you to create, store or paste. Uniqkey creates your organisation's key the first time an administrator unlocks Secrets Manager.

  1. In the Admin Portal, open Secrets Manager → Secrets in the left-hand menu.
  2. If Trusted Portal is not on in this browser, the portal asks you to open Uniqkey on your phone. Approve the request in the app within one minute.

From then on:

  • Every administrator uses the same organisation key. If you lose your phone, another administrator can still unlock Secrets Manager. Your secrets are not tied to one person.
  • Secrets Manager stays unlocked while Trusted Portal is on in this browser. Logging out, or switching Trusted Portal off at the bottom of the menu, locks it again. Next time, your phone asks for approval. Log out when you step away from a shared machine.
  • Uniqkey cannot unlock it for you. Support cannot read, recover or reset your secrets.

If you see "The organization's Secrets Key could not be verified", stop and contact Uniqkey support. It means your browser was offered a key that is not the one your organisation created, and the portal refuses to use it.

Plan your paths

Put the environment first. This is the one decision worth getting right at the start, because API keys are limited by path.

Every secret has a path. Slashes create folders:

/production/payments-api/db-password
/staging/payments-api/db-password
/production/billing/stripe-token

With /production/... and /staging/... at the top, you can give a staging pipeline a key that is refused every production value. If you organise by team first, you cannot.

Rules for paths:

  • Letters, numbers and - _ . / + = @. No spaces, no //, no ...
  • Up to 1024 characters, ending with a name after the last /.
  • These are the characters AWS allows, so secrets moved from AWS keep their names.
  • Paths are not encrypted. Uniqkey can see them. Do not put anything sensitive in a path.

Add secrets

One at a time

On the Secrets Store tab, select Create Secret and choose a type:

  • Parameter: a single value. A password, a token, a connection string, a block of JSON. Up to 48 KB.
  • Credential: fields that belong together: username, password, host, port, domain, TOTP secret, private key or certificate, and notes. Start from a template for PostgreSQL, MySQL, SQL Server, SSH, Windows/RDP or an API key, add your own fields, or switch to JSON mode and paste the whole thing.

Both types take an optional description and tags. Fill in the description. In six months it is the only thing that tells a colleague what the secret is for. Tags are shown but cannot yet be searched.

If a secret already exists at the path, the portal refuses and tells you. Nothing is overwritten by accident. To change a value, open the secret and edit it.

Many at once, from a spreadsheet

Use Secrets Store → Import CSV. Select Download template for the exact header row.

  • The file must be comma-separated UTF-8 with a header row. If your spreadsheet saves with semicolons, change the separator before you import.
  • path is required.
  • Add a value column for parameters, or credential columns (username, password, host, port, domain, totp, privatekey, notes) for credentials. One type per file.
  • description and tags are optional. Header names are not case-sensitive.

Every row is checked before anything is sent. A row with a missing, invalid, too long or repeated path is reported with its line number and skipped. A path that already exists is reported and skipped. You can safely run the same file again, so a half-finished import needs no cleanup.

Each row counts as one request. A file with more than about 300 rows reaches the per-minute limit, and the rows after that are reported as failed. Wait a minute and select Import again to send the rest.