Skip to main content

Secrets & Vault

Overview​

The Secrets & Vault section lets you securely store, rotate, and audit sensitive credentials across your organization. All secret values are AES-CBC encrypted in the browser before being sent — plaintext never crosses the wire.

You can connect external vault providers or use Nife's built-in Internal Vault.

Supported providers:

  • HashiCorp Vault
  • AWS Secrets Manager
  • Azure Key Vault
  • GCP Secret Manager

Dashboard Overview​

The page header shows a live summary of your vault:

MetricDescription
Vault ProvidersNumber of connected providers. Highlighted in orange if none are configured.
Total SecretsCount of all secrets currently stored.
Health StatusRatio of healthy to total providers (e.g. 2/3). Highlighted in red if any provider is unhealthy.

Vault Dashboard

Tabs​

The vault page is split into five tabs:

TabPurpose
ProvidersConnect, configure, sync, and delete vault providers
SecretsAdd, search, view, edit, export, and delete secrets
MigrationMove secrets from one vault provider to another
Access LogsAudit trail of every read, write, and rotation event
SettingsConfigure auto-rotation, access notifications, and log retention

Providers​

Connecting a Vault Provider​

  1. Click Add Provider (top-right of the page)
  2. Enter an optional Display Name (e.g. Prod AWS, Staging HashiCorp)
  3. Select the Organization to link the provider to
  4. Choose a Provider Type from the dropdown
  5. Fill in provider-specific fields (see below)
  6. Optionally check Set as default vault provider
  7. Click Add Provider

Add Vault Provider

Provider Actions​

Each connected provider card shows:

  • Status — healthy, unhealthy, or unknown with a colour indicator
  • Created date
  • Active / Inactive badge
  • Default badge (if it is the default provider)

Available actions per provider:

ActionDescription
EditUpdate the display name or rotate credentials (URL, token, mount path)
Link OrgAttach additional organizations to share this provider
Set DefaultMake this provider the default for new secrets
Test ConnectionPing the provider and refresh its health status
SyncStart a full sync job and poll until completion. Progress shown with a spinner.
PullImport secrets from the external vault into Nife
HistoryView the last 20 sync job records with counts of updated and failed secrets
DeletePermanently remove the provider

Linking Organizations​

A single vault provider can be shared across multiple organizations.

  1. Click Link Org on any provider card
  2. Select an organization from the dropdown and click Link
  3. Already-linked organizations appear in the list below
  4. To remove access, click Unlink next to the organization (requires confirmation)

You cannot unlink the last remaining organization. Delete the provider instead.

Sync Job History​

Click History on any provider to expand a panel showing the last 20 sync jobs. Each row shows:

  • Sync type (e.g. full)
  • Timestamp
  • Secrets updated (↑) and failed (✗)
  • Status badge: completed, completed_with_errors, or failed

Secrets​

Adding a Secret​

  1. Go to the Secrets tab
  2. Click Add Secret
  3. Select the vault to store it in (Internal or an external provider)
  4. Select the Organization
  5. Enter an optional Path (defaults to secrets)
  6. Enter the Key — use UPPER_SNAKE_CASE, e.g. DATABASE_URL
  7. Enter the Value
  8. Click Add Secret

Add Secret

The secret value is masked in the input and never shown in plaintext over the network.

Bulk Import from .env​

  1. Click Import .env in the Secrets tab header
  2. Paste or upload your .env file content
  3. Confirm the import — all key-value pairs are stored as individual secrets

Import Secrets

Searching and Paginating Secrets​

  • Use the search bar to filter by key name or path
  • Results paginate at 10 secrets per page
  • The pagination bar shows current range and total count

Secret Actions​

Each secret row supports:

ActionDescription
CopyCopies the decrypted value to clipboard
ViewOpens a detail dialog showing the decrypted value with show/hide toggle
EditOpens a dialog to overwrite the secret value
DeletePermanently removes the secret (requires permission)

Exporting Secrets​

Click Export .env to download all secrets on the current page as a .env file.

  • Each secret is fetched individually to retrieve its real value
  • Values containing spaces or special characters are automatically quoted
  • A warning is shown if any secret could not be fetched (fallback value used)

Migration​

The Migration tab lists secrets that can be moved between vault providers.

Migrating a Secret​

  1. Go to the Migration tab and click Refresh to load the list
  2. Find the secret you want to move
  3. Click Migrate next to it
  4. Select the Target Vault Provider from the dropdown
  5. Click Migrate Secret

The original secret is removed from the source provider after migration (preserveOriginal: false).

Access Logs​

The Access Logs tab shows a timestamped audit trail of all vault operations.

Each log entry shows:

FieldDescription
Operationread, write, rotate, delete, etc.
SecretThe key or secret ID that was accessed
TimestampWhen the operation occurred
UserUser ID or service account that triggered it
ProviderWhich vault provider was involved
IP AddressClient IP (if available)
Statussuccess (green) or failed (red)

Click Refresh to reload the latest 100 log entries.

Settings​

The Settings tab configures organization-wide vault behaviour.

Vault Settings

Auto-Rotation​

SettingDescription
Enable Auto-RotationToggle automatic secret rotation on/off
Rotation IntervalNumber of days between rotations (1–365). Shown when auto-rotation is enabled.

Changes are saved immediately on toggle or when you click out of the interval field.

Audit Log Retention​

Set how many days audit logs are retained (7–3650 days). Changes are saved on blur.

Security Notes​

  • Secret values are AES-CBC encrypted in the browser using the app encryption key before any network request is made
  • The backend stores and returns only ciphertext — decryption happens client-side
  • Vault provider configs (URL, token, mount path) are also encrypted before being sent to the backend
  • TLS verification is enabled by default for HashiCorp Vault connections