Secrets management

Secrets vault

Autessa Secrets stores credentials, such as third-party API keys, bearer tokens and webhook signing keys, that your tools can use but nobody can read back. No screen, API response, log or export shows a value: a script holds an opaque handle, and the value is filled in only inside the outgoing HTTPS request.

Start free

Secrets · stripe-livev3Sample

SealedManage••••a1b2

Allowed hostsapi.stripe.com

Bound toolsCharge card, Refund payment

ValueNever shown

Version3 · rotated Oct 28

Charge card · script tooljavascript

const key = secrets.ref("stripe-live");
// key is a handle: [[autessa-secret:…]]
// filled in only inside https://api.stripe.com

The problem

What problem does it solve?

API keys pasted into scripts end up in version history, logs, screenshots and the next contractor’s laptop. Environment variables are better, but anyone who can print them can copy them.

How it works

1
Create the secret
Open Secrets → New Secret. Enter a name such as acme-api-key, an optional description and the value, up to 16 KB.
2
Choose a mode and hosts
Sealed (recommended) or Revealable, and the exact hostnames it may be sent to.
3
Use it from a tool
A script calls secrets.ref("acme-api-key") and passes the handle to api.get, api.post and the rest.
4
Check the audit log
Every use, change and reveal is recorded on the secret.

Every option

Secrets vault: settings and options

Setting	What it does
Name	2 to 100 characters: lowercase letters, numbers, ., _ or -. Cannot be changed later.
Value	Up to 16 KB: a long token, a PEM key or a JSON service-account file.
Show last 4	For values of at least 12 characters, so you can tell keys apart.
Echo protection	If the other service echoes the value back, the script sees [redacted secret].
Signing helpers	secrets.verifyHmacSha256 returns only true or false; secrets.signJwtHs256 returns only the token.

Permissions

Who can do what?

Who	What they can do
Use	See details and use the secret from tools they run.
Reveal	Use, plus ask to see a Revealable value.
Manage	Everything: edit, rotate, seal, delete, share, read the audit log and decide reveal requests.
Company admins	Do not get access to secrets automatically.

FOR DEVELOPERS

Create a secret, then use it from a scriptbash

autessa secrets create --name acme-api-key --mode SEALED \
  --value @acme-key.txt --allowedHosts '["api.acme.com"]'
 
// in a script tool
const key = secrets.ref("acme-api-key");
const res = JSON.parse(api.get(JSON.stringify({
  endpoint: "https://api.acme.com/v1/me",
  headers: { "Authorization": "Bearer " + key }
})));

What to know

A handle works only during the execution that created it. Written to a row, a prompt, a response or a log, it is just the handle text.
Manage secrets in the web app, the CLI, the Poweruser API or a custom app’s SecretService.

Read the docs: Secrets →

Connections

How Secrets vault connects to the rest of Autessa

Reports, policies and security questionnaires are on the Autessa Trust Center.

FAQ

Secrets vault: questions

Can I see a secret after I save it?

Not for a Sealed secret, ever. A Revealable secret can be seen once per approved reveal request.

Can a script print a secret?

No. The script holds only a handle; printing it prints the handle text.

Can I verify Stripe or GitHub webhook signatures with a stored key?

Yes. secrets.verifyHmacSha256 checks the signature against the stored key in constant time and returns only true or false.

Get started with Secrets vault

Autessa Secrets stores credentials your tools can use but nobody can read back: scripts hold an opaque handle, and the value is filled in only inside the outgoing HTTPS request.

Start free

Reports, policies and questionnaires live on the Autessa Trust Center.

100% customizable, code and all

Make Autessa Security & Compliance fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours

Secrets vault

What problem does it solve?

Create the secret

Choose a mode and hosts

Use it from a tool

Check the audit log