Secret vaults

Create workspace vaults, reference credentials and rotate secrets used by connections.

A Secret Vault holds sensitive workspace configuration. The API calls this container a namespace. Product definitions store references to its secrets so credentials can be managed separately from flows.

Organization → Workspace → Secret Vault (namespace) → Secret

Create and use a secret

Choose the workspace

Select the organization and workspace that own the consuming connection. Vault and secret operations use both IDs.

Create a vault

Choose a name that identifies the application, environment or responsibility, such as production-data. Grant access to the identities that need to manage or reference it.

Store the credential

Create a secret with a descriptive key and purpose, such as postgres-password. Enter the credential through the secret-management flow.

Select the reference

In the connection form, select the vault and secret. Where permitted, you can create them inline. Validate the connection before saving it.

Reference format

A connection uses the namespace and key to identify a secret:

{
  "password_ref": {
    "namespace": "production-data",
    "key": "postgres-password"
  }
}

These are reference identifiers. The credential value stays in the secret system. The enclosing field depends on the connector: PostgreSQL uses password and SSH references, while API connectors can use token_ref.

See the PostgreSQL guide for complete authentication configuration.

Permissions

Collection permissions govern listing and creating vaults. Instance permissions govern access to a particular vault. Connection forms show the vaults and secrets visible to the current identity.

Grant permission to use a required credential separately from permission to administer secrets where the permission model permits it. Reading a connection does not reveal its credential values.

Rotate a credential

Update the secret through the authorized secret-management flow, then revalidate the consuming connections. If you select a different reference, update those connections and validate them before relying on the next run. Remove unused credentials and grants after consumers have migrated.

Keep secret values out of flow definitions, graph aspects, descriptions and logs. Use reference identifiers when sharing configuration examples.

Troubleshooting

Symptom	Check
Vault selector is empty	Organization/workspace selection and permission to view the vault.
Secret is missing	The secret exists in the selected namespace and is visible to the identity.
Connection rejects a reference	Namespace/key values, required connector fields and secret permissions.
Authentication fails after rotation	The external system accepts the new credential and the connection references the intended secret.

Continue with connections or access management.

On this page