For engineering
Deploy keys and tokens, somewhere your team can actually find them.
Stop pasting production credentials into Slack. Give infrastructure, CI, and services a vault with health you can see.
AWS — production
IAM secret, environment, and console address
Value
hidden valueSynthetic example. The values above do not open anything.
Why they use it
Engineering teams
Engineering secrets sprawl: an AWS key in someone's terminal history, a deploy key on a laptop, a shared login rotated once in 2023. One vault per system, shared with the people who work in it, turns that into a list you can read at a glance.
One vault per system
Infrastructure, CI, observability — each with its own vault, shared only with the engineers who go in there.
Health that catches reuse
The password that covers both Grafana and Sentry shows up flagged as reused. Before an incident finds it first.
Ready for agents
The MCP surface lets an agent list vaults and items, with values redacted by default and an explicit scope for whoever needs to read them.
How they manage secrets
Create a vault per environment or service — production, staging, atlas-api.
Add API keys, SSH deploy keys, and shared logins, with the fields each type asks for.
Generate the value on creation; the strength meter confirms what came out.
Share the vault with the on-call rotation — the role decides who edits and who only uses.
Follow vault health and rotate whatever comes up weak, repeated, or stalled.
Typical items
- API key
AWS — production
IAM secret, environment, and console address
hidden value - SSH key
Deploy key — atlas-api
public key, private key, and passphrase
hidden value - Login
GitHub — organization
shared login, with TOTP
hidden value
Questions
Can we limit what an agent sees?
Yes. The MCP tool that reads an item returns secret fields redacted by default; getting a value in the clear takes an explicitly requested scope, item by item.
How does rotation work?
Open the item, generate a new value, save. The strength meter and the vault's health counts change in the same instant. Scheduled rotation and reminders are on the roadmap.
Where does the data live?
In a Supabase project in the European Union, on your team's own account. The residency is yours: we run the application, the database is yours.