Skip to content
Registry

secrets

v0.1.1

Local protected secret store. Provider keys and other credentials are encrypted under a master key kept outside the project (secret://NAME) or kept as variables in the project's .env (env://NAME), referenced from versioned configuration and resolved only by the workers each secret allowlists; metadata reads never return a value, and the secrets::changed trigger reports rotations and .env edits.

license: Apache-2.0credentialssecretssecurityvault

Install

bash
iii trigger compose::add worker=secrets@0.1.1

Run in your project with the iii engine running. Exact versions are immutable and digest-pinned.

Functions1

secrets::set

Function

Store a credential under NAME (create, or rotate an existing one) and return its metadata. The value is encrypted at rest and never returned by this or any metadata function. Omitted consumers keep the current allowlist ([] for a new secret).

Request
  • consumersstring[]

    Worker names allowed to resolve. Omit to keep the current list (`[]` for a new secret).

  • descriptionstring

    Omit to keep the current description; an empty string clears it.

  • namestringrequired

    `^[A-Za-z_][A-Za-z0-9_.-]{0,127}$`; provider keys reuse their env var name.

  • valuestringrequired

    The credential. Stored encrypted; never returned except by `secrets::resolve`.

Response
  • consumersstring[]required

    Worker names allowed to resolve the value. Empty: nobody.

  • created_atstringrequired
  • descriptionstring
  • fingerprintstringrequired

    First 16 hex characters of HMAC-SHA256(master key, value). Changes on rotation.

  • hintstringrequired

    Masked value, e.g. `sk-ant…9f2c`; `••••` under 12 characters.

  • last_resolved_atstring
  • last_resolved_bystring

    Worker name of the last successful resolver.

  • namestringrequired
  • refstringrequired

    `secret://NAME`, the string to put in versioned configuration.

  • updated_atstringrequired

Triggers1

secrets::changed

Trigger

Fires after a secret is created, rotated, deleted or its consumers change. Carries name, ref, action, fingerprint and updated_at, never the value. Config: { names? } to narrow to some secrets.

Invocation
  • metadataunknown

    Metadata attached to every invocation this binding receives.

  • namesstring[]

    Secret names (or `secret://NAME` references) to fire for. Omit or leave empty for every secret.

Return
  • actionstringrequiredenum created, rotated, deleted, access_changed
  • fingerprintstring

    The current fingerprint; absent after a deletion.

  • namestringrequired
  • refstringrequired
  • updated_atstringrequired

Search the registry

Find workers, kits and executables, or jump to a page.