Everything sensitive in one place
Connection strings, the keys used for encryption and hashing, auth providers, API user passwords and the keys of third party services.
Security
Secrets Management
Keys, passwords and connection strings in one encrypted place, never in your code or in Git.
A secret is a TypeScript object of keys: database connection strings, encryption keys, sign-in settings and the API keys of the services you use. API Maker stores it encrypted, instances point to paths in it, and your code reads it with getSecret. Each environment and each developer has its own.
See it live
Step through it, slow it down, or open the full canvas.
api-maker/features/secrets-managementLive- Secrets
- 3DEV · QA · PROD
- Stored
- AESencrypted
- Requests use
- DEVthe default secret
- Restarts
- 0after a change
Every key in one secret. A secret is TypeScript: encryption and hashing keys, database connection strings, sign in settings, keys of Stripe or any service. Your code reads them with getSecret.
How it works
Every key in one secret.
A secret is TypeScript: encryption and hashing keys, database connection strings, sign in settings, keys of Stripe or any service. Your code reads them with getSecret.
Encrypted on the way and at rest.
The browser sends it encrypted. API Maker compiles it, runs it in the sandbox to get the keys, and stores all of it encrypted with the database secret.
Instances keep a path, not the password.
The connection string of an instance is a path in the secret. API Maker reads the value from the secret when it connects.
One secret per environment.
DEV, QA, UAT and PROD get their own secret, and every developer too. Every request uses the default one, and your code can read another one by its name. Secrets never go to Git.
Change it, it applies at once.
Saving a secret resets every cache. The next request already uses the new connection string or key: no restart, no deployment.
What you get
Instances point, not paste
The connection string of an instance is a path in the secret. The password never sits in the instance itself.
Read from code
g.sys.system.getSecret('stripe.secretKey') returns a value, anywhere you write code in API Maker.
One secret per environment
DEV, QA, UAT and PROD each get their own values, and so does every developer account.
Changes apply at once
Saving a secret resets the caches, so the next request already uses the new connection string or key.
Kept out of Git
Git deployment moves APIs, schemas and settings between environments, never the secrets.
An example
Same code, different environments
The payment key of production and the one of the test account live in two secrets. The code calls getSecret and each server gets its own key, so nothing has to change when a release moves from QA to production.
import * as T from 'types';let Secret: T.ISecretType | any = { common: <T.ISecretTypeCommon>{ encryptionAlgorithm: 'AES', secret: '…', // used by encryption conversions and encrypt-data hashingAlgorithm: 'SHA256', connectionString: { mongodb: 'mongodb://user:[email protected]:27017/?authSource=admin', }, }, stripe: { secretKey: 'sk_live_…' },};module.exports = Secret;An instance then uses common.connectionString.mongodb as its connection string.
Good to know
- The encryption keys of common are used for data already stored: changing them does not re-encrypt existing values.
Questions
Can I have more than one secret?
Yes. One is the default, and every request uses it. Your code can read another one by its name: getSecret(key, secretName).
Who can read a secret?
Code running in API Maker, and users of the admin panel with access to it. The get-secret-by-name system API is closed to outside callers unless you open it in its settings.
Learn more
Documentation