Secrets

How vly stores, encrypts, and serves secrets. Per-environment scoping, rotation, audit.

vly’s secret store is a vault for API keys, webhook signing secrets, OAuth client secrets, and any other server-only sensitive values.

How it works

• Stored encrypted at rest with AES-256.
• Decrypted only at function invocation, only on vly-controlled compute.
• Never exposed to client code.
• Never displayed in plain text in the UI after creation (you can rotate but not view).

Setting

Same as Environment variables — server-only env vars are secrets.

Audit

Every secret read is not logged (would generate too much noise). Every secret create / update / delete is audit-logged.

To see who touched a secret: Settings → Audit log → filter by action secret.*.

Rotation policy

Recommended:

• Rotate quarterly for routine secrets.
• Rotate immediately if you suspect compromise (a developer leaves; a key was leaked).
• Rotate at provider AND vly to avoid downtime.

Compromise response

If a secret is leaked:

1. Revoke immediately at the provider

   Stripe / Resend / OpenAI dashboard → Revoke key.

2. Generate a replacement

   New key at the provider.

3. Update in vly

   Settings → Environments → [env] → Variables → Edit.

4. Audit usage

   Check audit log for unexpected secret reads or downstream API calls.

5. Notify if needed

   If user data was at risk, follow your incident-response process.

What’s NOT a secret

• Public API keys (Stripe pk_, PostHog public key) — set as VITE_* so they reach the client.
• App URLs — also VITE_*.

Related

Secrets management

Best practices.

Environment variables

The configuration mechanism.

Audit logs

Tracking secret changes.