Secrets · Guides
Control who sees values
People get a level in Secrets from their role at id.my-beast.com, with a lower one for production if you like. Everything that opens a value is recorded.
Levels
A workspace's roles, kept at id.my-beast.com, give each person a level in each product of a project. In Secrets:
| Level | In an environment, they can |
|---|---|
| Viewer | See variable names, Visible values, the history and the .env page. Never a Secret value. |
| Triage | Also add, change and remove variables, show and copy Secret values, import, download the .env, roll back and make a variable Visible or Secret. |
| Admin | Also make and revoke the environment's service tokens, which read every value. |
| No access | Nothing: the environment isn't listed for them. |
The environments themselves, adding, renaming and marking them production, are the project's, managed by its admins on the project's page at id. Renaming one keeps its variables, history and tokens.
Production environments
A role may give Secrets a lower level in production than in the other environments, never a higher one. For example, Triage; in production: No access lets a developer work on development and staging without ever seeing a production value.
- Which environments are production is a tick on each, on the project's page at id. A new environment is ticked unless its name is a known non-production one, such as
development,staging,testorpreview. - With No access in production, its pages answer “You don't open production in Secrets”, and it's left out everywhere else: the environment switch, Compare, the Tokens page, the search.
- With Viewer in production, they see its names and Visible values only.
- A production token is made and revoked by someone with Admin in production.
Other products tell no more
The audit log
Everything that changes a variable or opens a value is written in the project's audit log, with who (or which token) and when:
| What | Recorded with it |
|---|---|
| A variable added, changed or removed | Its name, the environment and the change's number |
| A .env imported | The names it added and changed |
| A change rolled back | The change it put back |
| A value shown or copied | Its name and the environment |
| A .env downloaded | The environment and how many variables |
| A read with a service token | The token, the environment, the format and how many variables |
| A variable made Visible, or Secret again | Its name and the environment |
| A service token made or revoked | The token and, when made, its environment |
| An environment added, renamed or marked production | Its name, as id.my-beast.com sent it |
A value is never written in the log, only that it was opened. Reading a Visible value on a page isn't recorded: it's on every page for everyone who opens the project. How long the log is kept is on Data and privacy.