AppsSecurity & Compliance

Security & Compliance · topic

Secrets management

A secret is used, never viewed: tools get a handle, the value is filled in only inside an HTTPS request to an allowed host, and seeing it takes two people.

A secrets vault for API keys and tokens: used by tools, never viewed, sent only to allowed hosts, rotated by name and revealed only with a second approval.

Start free
Reveal request · vendor-portalRevealableSample
  1. 1Request · Priya · Reveal access“Re-entering the vendor portal password after the laptop swap.”
  2. 2Approve · Sam · Manage access (not Priya)Nobody can approve their own request
  3. 3View once · Priya, signed inWithin 15 minutes · then the request is used up
MACHINE_IDENTITY_CANNOT_REVEAL

Keys, scripts, apps and scheduled runs are always refused, even with an approved request.

How it fits together

How does secrets management work in Autessa?

Secrets in Autessa are used, never viewed. A tool gets an opaque handle, the value is filled in only inside an HTTPS request to the hosts you allowed, and every use, change and reveal is logged. Seeing a value takes two people, and automation can never see one.

IN THIS AREA

  • Sealed and Revealable modes
  • Exact allowed hosts, HTTPS only
  • Two-person, view-once reveal
  • Rotation by version and a per-secret audit log

In this area

Every secrets management feature

01Secrets vaultAutessa Secrets stores credentials your tools can use but nobody can read back: scripts hold an opaque handle, and the value is filled in only inside the outgoing HTTPS request.→02Allowed hosts and bound toolsA secret is sent only over HTTPS to the exact hostnames you list, so even an edited tool cannot send your Stripe key anywhere but Stripe, and binding limits it to the tools you trust.→03Sealed secrets and two-person revealSealed secrets can never be seen by the owner, an admin or support; a Revealable secret is shown once, only after a second person approves a request, and automation can never reveal at all.→04Secret rotation and audit logRotating a secret bumps its version while tools keep working by name, and each secret keeps an audit log of every change, share, use, denial and reveal, never the value.→

Other areas

The rest of Autessa Security & Compliance

FAQ

Secrets management: questions

Can I see a secret after I save it?

Not for a Sealed secret, ever. A Revealable secret can be seen once per approved reveal request.

Can I allow *.example.com?

No. Wildcards are not accepted; list each exact hostname, up to 50.

Can Autessa support see my sealed secrets?

No. A Sealed secret cannot be viewed by anyone: not the owner, not an admin, not support.

Do I have to update my tools when I rotate a key?

No. Tools refer to the secret by name, and every execution after the rotation uses the new value.

Secrets management, built in

A secret is used, never viewed: tools get a handle, the value is filled in only inside an HTTPS request to an allowed host, and seeing it takes two people.

Start free

Reports, policies and questionnaires live on the Autessa Trust Center.

100% customizable, code and all

Make Autessa Security & Compliance fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours