Skip to main content

✍️ Add and share secrets

Anyone can keep secrets in their own personal folder. To add one to a shared folder you need the Manage permission there, which a folder's owners have.

Anyone signed in can also start a new top-level folder with New shared folder in the sidebar, and owns it, unless a site admin turned on Restrict top-level folders to admins (Top-level folders).

➕ Create a secret​

  1. Choose New secret (from a folder you can manage, or from your personal folder).
  2. Pick its type. The type decides the fields and what Sneakers-PAM can do with it; see Secret types for the list.
  3. Fill in the fields. For the types below, the editor can make the value for you:
    • A password field: generate one that meets the folder's password policy.
    • An SSH key: generate a key pair in the vault (Ed25519, RSA 4096, RSA 2048 or ECDSA P-256), or import one you have. The private key is stored and never shown in the editor again.
    • A certificate: upload a PKCS#12 / PFX, PEM, DER, PKCS#7, JKS or JCEKS file; its details are read from the certificate.
  4. Save. The first version of the secret is recorded.

The editor marks the fields the type requires. A save with one of them empty is refused, and the message names the field. For a GitHub App, see Storing a GitHub App.

Values that are already in a file

To store a value that's already on disk, such as a key file, without pasting it, use sneakers-put, which reads it from the file (Agents and the MCP).

✏️ Edit, move and retire​

  • Edit changes fields; every save that changes something makes a new version, and the history shows which fields changed.
  • Change type moves a secret, or several from a folder's list, to another type, with a preview of what happens to each field before you confirm (Changing a secret's type).
  • Move a secret to another folder you can manage. From your personal folder to a shared one is free. From a shared folder into a personal one needs a site admin: for anyone else it becomes a move request that a site admin decides.
  • Retire takes a secret out of use without deleting it; it's hidden from lists unless you show retired secrets, and it can be restored.

🤝 Share a folder or a secret​

Open a folder's or a secret's Manage access (the Actions menu on a secret) to choose who can do what. Folder changes apply to everything in the folder and its subfolders once saved; secret changes apply to that secret.

PermissionWhat it lets someone do
RevealRead the secret's fields and reveal or copy its values
ManageAdd, edit, move and retire secrets, and change sharing
ApproveDecide other people's access requests and reveals for it
InformedGet notifications about it, such as a move or a rotation
  • Share with a person, a group, or everyone who can sign in (only a site admin can change a rule for everyone).
  • Owners of a folder have Reveal, Approve and Manage on everything in it.
  • Rules inherited from a folder above are shown as inherited and locked here; change them on that folder.
  • Advanced (RACI grid) shows the rules in order, each allowing or denying, the way a firewall reads them: the first rule that matches decides. A deny there wins over the simple view.
  • What would this user get? The simulator shows what a person would be allowed, with your unsaved changes, before you save.

Site admins can see every shared folder but aren't approvers or managers by themselves; they get those only through a rule, like anyone else (Folders and permissions).