The vault that ships today.

Built-in vault

Passwords, keys, and certificates are stored here. The forms cover a user credential, an API key, OAuth, a webhook signing secret, a certificate and private key, an SSH key, a TOTP seed, a synthetic login, a cloud credential, an OpenShift token, and an encryption key. A cloud credential stored this way is a secret in this vault. It is not a connection to that cloud’s secret manager.

Each secret is sealed with AES-GCM. A random data key wraps the payload. ONEMONVUE_SECRET_KEY wraps that data key. When the master key changes, ONEMONVUE_SECRET_KEY_PREVIOUS opens the older data key and the store seals it again with the current key. If ONEMONVUE_SECRET_KEY is unset, the process warns and uses a development key. That key is not safe outside a local demo.

A list does not decrypt the secret. The mask is four bullets. When the value is longer than eight characters, the last four follow the bullets. Owner and Super Admin can open the list and the audit. Only the Owner can reveal a value. Super Admin cannot. The audit records create, read, reveal, use, rotate, and delete. The value is not written there. A denied reveal is recorded as denied.

Rotate saves a new version. An expiry date can raise a reminder, and that window defaults to 14 days. A synthetic check or an integration uses a secret that was already saved. Only an Owner or a Super Admin can attach one. This site does not claim SOC 2, ISO, or any similar mark.

External connectors

These connections are not available yet.

• CyberArk Coming soon
• HashiCorp Vault Coming soon
• AWS Secrets Manager Coming soon
• Azure Key Vault Coming soon
• GCP Secret Manager Coming soon