Secrets
Add and manage developer-facing secrets. Org-secret policy is referenced from Admin.
Secrets are env vars and files your agents need at runtime, like API keys or config files that shouldn't live in the repo. Proliferate stores them encrypted and materializes them into the environment agents run in.
The stored secret scopes ship with cloud workspaces, which are coming soon.
Local workspaces read your shell environment and checkout directly, so keep
using your usual .env files, shell profile, or secret manager for now.
Three scopes
Each scope is a separate page, and the effective set of variables is the union of all three: workspace overrides personal overrides organization when the same name is set in more than one place.
| Scope | Where | Applies to |
|---|---|---|
| Personal | Settings → User → Personal secrets | Only you. |
| Organization | Settings → Org → Organization secrets | Every member. Admin-managed. |
| Workspace (repo) | Settings → Repo → Environment | Only this repository's workspaces. |
Env vars and files
Each scope holds two kinds of secret:
- Env vars. A name and a value, injected into the environment agents run in.
- Files. A path and content (typed directly or uploaded), written into the workspace filesystem. Personal and organization file paths are absolute; workspace file paths are relative to the repo checkout.
Values are write-only once saved: the list view shows name or path, size, and last-updated time, never the stored value. To rotate a secret, replace it; to remove it, delete it.
Materialization status
Each scope reports whether its secrets have been written yet: pending, running, ready, or error. If a secret shows an error status, re-saving it triggers another materialization attempt.
Organization secrets
This scope is admin-managed, not something you set up here: only owners and admins can add, replace, or delete organization secrets, though every member sees the effective set of names available to them. See Organization secrets for how admins manage it and how it layers with your personal scope.
Workspace (per-repo) secrets
Settings → Repo → Environment holds variables and files scoped to one repository, useful for repo-specific credentials you don't want available everywhere. There is no local secret store, by design, since local workspaces already have your shell.