--- title: "E2E Secrets Management FAQ" description: "Short answers about E2E Secrets Management, where the token comes from, what it can do, unsealing, plans and upgrades, billing, and deleting." content_type: "faq" product: "secrets" platform: "MyAccount" url: "/myaccount/secrets/faq/" --- # E2E Secrets Management FAQ [Troubleshooting E2E Secrets Management](/myaccount/secrets/troubleshooting/secrets/) helps with a secret that stays on **Creating**, a credentials email that does not arrive, and portal messages. ## The secret store ### What is a secret in E2E Secrets Management? A secret is a dedicated OpenBao secret store: a separate server with its own address. You keep your API keys, passwords, and certificates in it as values, and read them with the `bao` command-line tool or a client library. See [E2E Secrets Management](/myaccount/secrets/). ### Which tools can I use with my secret store? You can use the `bao` command-line tool, or any client library that works with the Vault API, such as hvac for Python. Each needs the store's address and a token. See [Connect to a secret](/myaccount/secrets/how-to/connect-to-a-secret/). ### Do I need to unseal the store? No. E2E takes care of unsealing, and that includes after the store restarts. See [What your token can do](/myaccount/secrets/how-to/connect-to-a-secret/#what-your-token-can-do). ### Can I store a whole .env file? Yes, as separate values. Give each variable as its own `key=value` pair in one `bao kv put` command. You can also put them in a JSON file and pass it with `@`. See [Store and read values](/myaccount/secrets/how-to/connect-to-a-secret/#store-and-read-values). ## Credentials and tokens ### Where do I find the token and the address? On the page the credentials email links to. When a secret reaches **Running**, E2E emails the account owner a link to a page with the store's token and domain. The domain is also under **Domain** on the secret's **Info** tab in MyAccount. See [Get the address and token](/myaccount/secrets/get-started/#get-the-address-and-token). ### Who receives the credentials email? The account owner, no matter which user created the secret. See [How you get the credentials](/myaccount/secrets/#how-you-get-the-credentials). ### How long does the credentials link work? For 168 hours (seven days) after the email is sent. You can open it as many times as you like in that time. After that, the page reads **Your Password link is expired.** Save the token before then. See [Get the address and token](/myaccount/secrets/get-started/#get-the-address-and-token). ### Can I see the token in MyAccount? No. MyAccount shows the store's address under **Domain**, and the token is only on the page the credentials email links to. See [How you get the credentials](/myaccount/secrets/#how-you-get-the-credentials). ### Is the emailed token a root token? No. It is a renewable token with the policy `default`. E2E keeps the store's root token and recovery keys. See [What your token can do](/myaccount/secrets/how-to/connect-to-a-secret/#what-your-token-can-do). ### What can my token do? Everything on every path in your store. That includes turning on secrets engines and auth methods, storing and reading values, writing policies, and creating and revoking tokens. The exceptions are store operations E2E looks after: sealing and unsealing, rotating and rekeying the encryption keys, and generating a root token, among others. See [What your token can do](/myaccount/secrets/how-to/connect-to-a-secret/#what-your-token-can-do). ### How long does a token last? 87,600 hours (10 years), unless you revoke it. That covers the emailed token, and every token you create from it unless you set a shorter lifetime. See [Create a token for each application](/myaccount/secrets/how-to/connect-to-a-secret/#create-a-token-for-each-application). ## Plans and billing ### Does upgrading a secret keep my stored values? Yes. The upgrade enlarges the store's storage in place and raises its RAM, and every value stays. See [Upgrade a secret](/myaccount/secrets/how-to/upgrade-a-secret/). ### Can I move a secret to a smaller plan? No. **Upgrade Secret** offers the plans after your current one, and the new plan needs at least as much storage. To use a smaller plan, create a new secret on it and move your values across. See [Upgrade a secret](/myaccount/secrets/how-to/upgrade-a-secret/). ### How is a secret billed? By the minute, at its plan's hourly price, from when it reaches **Running** until you click **Delete**. A secret that never reached **Running** is not billed. After an upgrade, the new plan's price applies from when the upgrade finishes. The bill lists each secret by its plan, **Name**, **Size**, and the hours it ran. For prices, see [E2E's pricing page](https://www.e2enetworks.com/pricing). ### How much credit do I need to create a secret? On a prepaid account, you need enough infra credits for 24 hours of the plan's hourly price. The same applies to an upgrade, at the new plan's price. See [Credit Balance is Low.](/myaccount/secrets/troubleshooting/secrets/#credit-balance-is-low). ## Managing secrets ### Who can create, upgrade, or delete a secret? An **Admin** or a **Project Lead** can create, upgrade, and delete secrets. Any other user can do what their policy set allows in the project, and MyAccount shows **Create New Secret**, **Upgrade**, and **Delete** to users who have the matching permission. To see who has access to your account, and with which role, see [Manage users](/myaccount/account/how-to/manage-users/). See also [Create a policy set](/myaccount/account/how-to/create-a-policy-set/) and [Upgrade or Delete is missing](/myaccount/secrets/troubleshooting/secrets/#upgrade-or-delete-is-missing). ### Can I recover a deleted secret? No. Deleting removes the store with every value in it, and its address stops working. Copy out anything you need first. See [Delete a secret](/myaccount/secrets/how-to/delete-a-secret/).