API keys, connection strings, signing secrets — encrypted at rest, versioned, audited, and kept out of your repository.

Create and read secrets

Dashboard: Secrets Vault. Terminal:

setcloud secrets create prod/api-key "example-value-123" --description "Payments API"
setcloud secrets get prod/api-key
setcloud secrets update prod/api-key "example-value-456"
setcloud secrets list

Versions

Every update writes a new version:

setcloud secrets versions list prod/api-key

Deleting — and undeleting

setcloud secrets delete prod/api-key            # 7-day recovery window
setcloud secrets restore prod/api-key           # changed your mind
setcloud secrets delete prod/api-key --force    # immediate and permanent

Default deletes keep a 7-day recovery window. --force skips it.

Deleting a project removes its project-managed credentials, such as generated database credentials. Your customer-created Vault secrets and their versions remain, even if that project was their last link; the project’s links and runtime access are removed. Delete those secrets separately when no longer needed. Retained secrets continue normal storage billing.

Read credentials from your app

Link the secret to your project under Linked Secrets and redeploy. Your server-side application can then read it by name with the Secrets SDK:

npm install ./setcloud-secrets-0.1.0.tgz
import { getSecret } from '@setcloud/secrets';
const credentials = JSON.parse(await getSecret('prod/database'));

The deployed workload uses temporary identity credentials automatically. Keep only the secret name in your source; do not add an account key or platform token. Default reads fetch the current value on every call, so the next read sees a rotation. Your application remains responsible for refreshing database connections that used an older value.

Adding or removing a linked secret requires redeployment. Linked environment variables and the platform-managed DATABASE_URL remain startup values; they update when new app instances start. Never place secret values in static browser bundles or build arguments. See the quickstart for caching, version selection, and environment-variable examples.

Utilities

setcloud secrets generate-password --length 40
setcloud secrets tag prod/api-key env=prod team=payments

Audit and pricing

Secret operations appear in the dashboard audit trail. Runtime reads are collected asynchronously and can appear after a delay. Usage received after a monthly bill is finalized appears on a later bill; the audit trail keeps the actual request time. Storage is prorated by active time; a secret marked for deletion stops storage billing until restored. API operations bill separately. See the current Secrets Vault rates.

Quickstart: /docs/secrets/quickstart.

Scheduled rotation integrations and custom external identity policies are not currently available. Update the value to create a new version, and use project secret links to control runtime access.