No secret should live in plaintext anywhere
Every workspace ships with a per-tenant HashiCorp Vault namespace. SSH keys, Git tokens, registry credentials, and cloud-provider keys live there. Resolved just-in-time during deploys.
In the dashboard (UI)
Dashboard → Settings → Vault. The page lists every credential currently registered in your workspace, grouped by category (Cloud Providers, Git, Docker Registries, SSH Keys, Custom).
Add a cloud provider credential
Click "Add Credential" → category "Cloud Provider" → pick Alibaba / AWS / Azure / Google Cloud / Linode / DigitalOcean. The form asks for whatever the provider needs (Access Key + Secret for AWS, Service Account JSON for Google Cloud, etc). Save — credentials are written to your workspace Vault namespace and the audit log records the create event.
Add a Git token
Same dialog, category "Git". Pick provider (GitHub / GitLab / Bitbucket), give it a friendly name (e.g. "work-personal-token"), paste the PAT. The token is reused in every deploy that pulls from your Git provider.
Add a Docker registry credential
Category "Docker Registry". Pick Docker Hub, GHCR, ECR, or Custom Registry. Paste username and password (or AWS credentials for ECR). The Custom Compose deploy resolves these by slug at deploy time.
Rotate a credential
Click any credential → "Rotate". Paste the new value → Save. Active sessions continue using the old credential until they finish; new sessions immediately use the rotated one. The audit log records the rotation event with old/new key fingerprints.
Stuck halfway through? Email [email protected] — most replies land within an hour during weekdays.
All guidesWas this page helpful?