UPVALE / GUIDES
Secrets
Store application credentials, choose their scope, reference them in variables, and rotate them safely.
On this page
Secrets hold passwords, API keys, and other values that should not be written into ordinary configuration fields. Open Secrets in the sidebar. You need Manage secrets to create, rotate, or remove them.
Create and use a secret
- Select New secret.
- Enter a recognizable Name, such as
PAYMENT_API_KEY. - Paste its Value.
- Set Scope to Organization-wide or a specific project.
- Add an optional Description, then select Store secret.
- Open an application or scheduled job's Environment variables section.
- Add the environment variable your code expects, choose secret as its value source, and select the saved secret.
- Save the workload and deploy it, or run the job with the updated configuration.
The variable name and secret name do not have to match. For example, your application can read DATABASE_URL while the selected secret is named PRODUCTION_DATABASE_CONNECTION.
Fields and scope
| Field | What it means |
|---|---|
| Name | Identifies the secret in selectors and the secret list. Names must be unique within their scope. |
| Value | The sensitive value. It is write-only: the Secrets screen does not reveal it after saving. |
| Organization-wide | Makes it available to workloads across the organization. |
| Project scope | Limits references to that project. Organization secrets remain available alongside its project secrets. |
| Description | A reminder of what the credential is for. Keep the value itself out of this field. |
| Version / Rotated | Shows how many versions have been stored and when the value last changed. |
The environment editor has a structured view and a text view. In text view, the editor supports secret references such as DATABASE_URL=[DATABASE_CONN_SECRET]. Pick from the available secrets when names are ambiguous; do not paste a password as a plain value just to bypass a missing selection.
Rotate a value
- Find the secret and select its Rotate action.
- Enter the New value and select Rotate.
- Deploy each application that must receive it. Rotation alone does not restart running containers.
- For a scheduled job, verify the value with a new run before relying on the next scheduled execution.
The stored reference stays the same, so workloads do not need to select the secret again. Coordinate rotation with the system that issued the credential so the old running workload is not locked out before the new one is deployed.
Delete a secret
Remove the references from workloads and deploy those changes before deleting the secret. Upvale blocks deletion when desired, deployed, or pending workload configuration still relies on it. If deletion is blocked, inspect those configurations and allow pending work to finish.
Managed database credentials, registry passwords, S3 keys, and Compose-managed secret material have their own configuration flows. Use their owning screen to change them. See Databases, Registries, Storage, and Compose.