Skip to content
My Beast
Cart
Developer docsMenu

Secrets · Getting started

Secrets

Every .env your apps need, kept in one place per project and environment, and pulled where it is needed.

Secrets is for the people who build and run an app: the database password, the payment provider's key and the mail server's address live here instead of in a .env passed around by hand. Values are encrypted before they're stored, every change is kept and can be rolled back, and each server reads its own environment with a read-only token, through the mybeast-secrets command or the API.

How it works

EnvironmentsThe project's, the same in every My Beast product: development, staging and production to start. They're added, renamed and marked production on the project's page at id.my-beast.com.
VariablesEach environment has its own: a name such as DB_PASSWORD and a value. A value is Secret, hidden until someone shows it, or Visible, shown on every page. See Make a value Visible.
HistoryEvery add, change, removal, import and roll back is a numbered change in its environment's history, with who made it and when. Any change can be rolled back.
Service tokensA token reads one environment and nothing else, and changes nothing. Give every server, deploy and laptop its own. See Manage service tokens.
mybeast-secretsOne bash file that writes an environment to a .env, or starts a command with its variables and writes nothing. See CLI.
Your My Beast keysWhen the project also has other My Beast products, id.my-beast.com writes their keys (the MYBEAST_… lines their setup asks for) into every environment, as an import of its own.
The audit logEach read with a token, each value shown and each download of a .env is recorded, with every change. See Who did what.

A server needs two lines in its environment, and then one command:

Terminal
export MYBEAST_SECRETS_URL=https://services.my-beast.com/secrets
export MYBEAST_SECRETS_TOKEN=st_….…
mybeast-secrets pull

That writes the environment's variables to .env, readable by its owner only. The quickstart takes you there from the start.

What you need

  • A project with Secrets, ordered at id.my-beast.com. The packages and their prices are on Secrets' page.
  • On each machine that reads variables: bash 3.2 or newer (macOS's own will do) and curl, for mybeast-secrets. Anything else that can make an HTTPS request can use the API instead.

Explore the docs

QuickstartFrom a new project to a server with its .env, in five steps.Add and change variablesAdding, changing, showing and removing values, one environment at a time.Import a .envPaste the file you have and see what each line does before anything changes.Pull variables on a serverA .env on disk, or a command started with its variables.CLIInstalling mybeast-secrets, its commands and what it says.APIOne endpoint: an environment as JSON, a .env or shell lines.