Secrets · Guides
Make a value Visible
Every variable is Secret or Visible. A Secret value stays hidden until someone shows it; a Visible one is on every page, for addresses and hosts there's nothing to hide about.
Secret or Visible
| Where | Secret | Visible |
|---|---|---|
| The list | The name only, with Show and Copy, which are recorded | The value, with Copy |
| History, Compare, the .env page | The name only | The value |
| Who sees the value | Triage or Admin in the environment, when they show it | Everyone who opens the project in Secrets, Viewers too |
| The search | Finds it by name | Finds it by name, and by what it holds |
| Machines and downloads | Read it | Read it |
| Stored | Encrypted | Encrypted |
So Visible changes only who sees a value on the pages. A database host or a public key is easier to work with Visible; a password, a key or a token stays Secret.
What is suggested
When you add a variable or import a .env, Secrets suggests one or the other from the name and the value:
- Visible: a name ending in
_URL,_HOST,_PORT,_REGION,_ENVIRONMENTor_PUBLIC_KEY, andAPP_NAME. - Secret: a name ending in
_SECRET,_PASSWORD,_TOKENor_KEY. - Secret, whatever the name: a hook's address (
…_WEBHOOK_URL,…_HOOK_URL), which is its own secret, and a value with a password in its address (https://user:password@…) or a key in its query (?token=…).
It's a suggestion, and you decide. With none, a variable is Secret. Keys that id.my-beast.com writes for your other My Beast products arrive the same way: their addresses Visible, their secrets Secret.
Switch a variable
Make Visible and Make Secret are behind a row's ⋯. Making one Visible asks first, as its value will then show to everyone who can open the project. Both take Triage or Admin in the environment, and each switch is recorded in the audit log, per name.
When some Secret variables look like nothing to hide, the list says so above the rows. Choose Could be Visible to see them, then the button under the note, such as Make all 3 Visible, to switch them at once. It asks first too.
A switch isn't a change in the history: no value changes, and machines read exactly what they read before.
Values in the history
The history shows a change's old and new values only when the variable was Visible when the change was made and is Visible still. So:
- Making a variable Secret hides its past values too.
- A variable that was Secret keeps its past values hidden when you make it Visible.
Comparing a Visible value with a Secret one