Vault

Vault holds the secret material for an environment: "Manage environment API secrets and vault entries." It covers three things: API keys your backend uses to call Authdog, encrypted values your workloads read, and the encryption keys that wrap them.

Analytics

Usage of the keys and secrets in this environment: which keys are being exercised, how often, and when each was last seen. A key with no recent activity is a candidate for revocation.

API Keys

"API access": "Create scoped environment secrets for backend access."

Click "Add new" to mint a key. Keys are scoped to the environment they were created in, so a dev key cannot read prod data. Empty environments read "No secrets yet."

Use these from server-side code to call the Authdog management and identity APIs. They are not for browsers, a public client uses the project and environment IDs from Overview instead.

Secrets

"Store encrypted environment variables and secret values."

Add a named entry with "Add new"; the value is encrypted at rest with the environment's default KMS key. This is where third-party credentials belong (a Stripe secret key, an SMTP password, a provider client secret) rather than in your own configuration files.

KMS

"Key management (KMS)": "Encryption keys for this environment. Secrets in the vault can be wrapped with a default key; decrypt and rotate using policies you attach to workloads."

The table shows Name, Algorithm, DEK stored, Status, and Created. "Add new" creates a key and designates how new secret material is encrypted for the environment.

The page states the rotation contract plainly: "Default keys apply to new encrypted secret material. Rotating a key marks the old material for re-wrap in the vault; plan a maintenance window before disabling a key that is still in use."

KMS performance

Measured with the same WebCrypto helpers the management service uses, on one machine (Intel Core Ultra 7 165H, Bun 1.3.14). Times are per operation, in milliseconds, after warm-up. Network and database lookups are not included; expect production latency to be higher.

AES-256-GCM is the right choice for secrets read on hot paths. RSA-OAEP-4096 decryption is roughly 400 times slower, and key generation takes about half a second, so create RSA keys ahead of time and avoid decrypting with them per request.

How the three fit together

1. KMS defines the encryption keys.
2. Secrets stores values wrapped by the default key.
3. API Keys are the credentials your backend presents to read them.

Related