E2E Secrets Management

E2E Secrets Management gives you a secret store of your own. Keep your API keys, passwords, database credentials, certificates, and encryption keys in it, and hand them to your applications from there.

Each secret you create in MyAccount is a dedicated OpenBao secret store: a separate server with its own address. OpenBao is an open-source secret store with the same API as HashiCorp Vault. The store encrypts everything it writes to its disk.

You work with the store through the bao command-line tool or any client library written for the Vault API. You reach the store over HTTPS at its own address, and each tool uses the store’s token. Inside the store, you decide how your values are organized and which applications get a token.

Where to find it

In the MyAccount side menu, click E2E Secrets Management. The list of your secrets opens, with each secret’s Name, RAM and Storage in GB, and Status. A secret is ready to use when its status reads Running.

The list covers the project and the region, Delhi or Chennai, selected in MyAccount. To see another project’s secrets, switch to that project first.

To see a secret’s details, click its name. Its Info tab opens below the list. Domain is the store’s address, which you can copy from there, and Plan is the plan the secret runs on.

How you get the credentials

When a secret reaches Running, E2E emails the account owner a link to its credentials. The email goes to the owner, no matter which user created the secret. The link opens a page with the store’s token and domain, and it works for 168 hours (seven days).

MyAccount shows the address but never the token, so save the token somewhere safe before the link expires. The token is not a root token: E2E keeps the store’s root token and recovery keys, and unseals the store for you. For what the token can do, see Connect to a secret.

What you can do

• Connect to a secret with the bao command-line tool or a client library, and store and read your first values.
• Upgrade a secret to a plan with more RAM and storage, keeping everything stored in it.
• Delete a secret and its store when you no longer need it.

E2E bills a secret by the minute at its plan’s hourly price, from when it reaches Running until you click Delete. See How is a secret billed? and E2E’s pricing page.

Where to start

To create your first secret and store a value in it, follow Get started with E2E Secrets Management. The E2E Secrets Management FAQ has short answers about the token, plans, and billing. Troubleshooting E2E Secrets Management helps with a secret that stays on Creating, a missing email, or a portal message.