E2E CloudE2E Secrets Management FAQ
Troubleshooting E2E Secrets Management helps with a secret that stays on Creating, a credentials email that does not arrive, and portal messages.
The secret store
Section titled “The secret store”What is a secret in E2E Secrets Management?
Section titled “What is a secret in E2E Secrets Management?”A secret is a dedicated OpenBao secret store: a separate server with its own address. You keep
your API keys, passwords, and certificates in it as values, and read them with the bao
command-line tool or a client library. See E2E Secrets Management.
Which tools can I use with my secret store?
Section titled “Which tools can I use with my secret store?”You can use the bao command-line tool, or any client library that works with the Vault API, such
as hvac for Python. Each needs the store’s address and a token. See
Connect to a secret.
Do I need to unseal the store?
Section titled “Do I need to unseal the store?”No. E2E takes care of unsealing, and that includes after the store restarts. See What your token can do.
Can I store a whole .env file?
Section titled “Can I store a whole .env file?”Yes, as separate values. Give each variable as its own key=value pair in one bao kv put
command. You can also put them in a JSON file and pass it with @. See
Store and read values.
Credentials and tokens
Section titled “Credentials and tokens”Where do I find the token and the address?
Section titled “Where do I find the token and the address?”On the page the credentials email links to. When a secret reaches Running, E2E emails the account owner a link to a page with the store’s token and domain. The domain is also under Domain on the secret’s Info tab in MyAccount. See Get the address and token.
Who receives the credentials email?
Section titled “Who receives the credentials email?”The account owner, no matter which user created the secret. See How you get the credentials.
How long does the credentials link work?
Section titled “How long does the credentials link work?”For 168 hours (seven days) after the email is sent. You can open it as many times as you like in that time. After that, the page reads Your Password link is expired. Save the token before then. See Get the address and token.
Can I see the token in MyAccount?
Section titled “Can I see the token in MyAccount?”No. MyAccount shows the store’s address under Domain, and the token is only on the page the credentials email links to. See How you get the credentials.
Is the emailed token a root token?
Section titled “Is the emailed token a root token?”No. It is a renewable token with the policy default. E2E keeps the store’s root token and
recovery keys. See
What your token can do.
What can my token do?
Section titled “What can my token do?”Everything on every path in your store. That includes turning on secrets engines and auth methods, storing and reading values, writing policies, and creating and revoking tokens. The exceptions are store operations E2E looks after: sealing and unsealing, rotating and rekeying the encryption keys, and generating a root token, among others. See What your token can do.
How long does a token last?
Section titled “How long does a token last?”87,600 hours (10 years), unless you revoke it. That covers the emailed token, and every token you create from it unless you set a shorter lifetime. See Create a token for each application.
Plans and billing
Section titled “Plans and billing”Does upgrading a secret keep my stored values?
Section titled “Does upgrading a secret keep my stored values?”Yes. The upgrade enlarges the store’s storage in place and raises its RAM, and every value stays. See Upgrade a secret.
Can I move a secret to a smaller plan?
Section titled “Can I move a secret to a smaller plan?”No. Upgrade Secret offers the plans after your current one, and the new plan needs at least as much storage. To use a smaller plan, create a new secret on it and move your values across. See Upgrade a secret.
How is a secret billed?
Section titled “How is a secret billed?”By the minute, at its plan’s hourly price, from when it reaches Running until you click Delete. A secret that never reached Running is not billed. After an upgrade, the new plan’s price applies from when the upgrade finishes. The bill lists each secret by its plan, Name, Size, and the hours it ran. For prices, see E2E’s pricing page.
How much credit do I need to create a secret?
Section titled “How much credit do I need to create a secret?”On a prepaid account, you need enough infra credits for 24 hours of the plan’s hourly price. The same applies to an upgrade, at the new plan’s price. See Credit Balance is Low..
Managing secrets
Section titled “Managing secrets”Who can create, upgrade, or delete a secret?
Section titled “Who can create, upgrade, or delete a secret?”An Admin or a Project Lead can create, upgrade, and delete secrets. Any other user can do what their policy set allows in the project, and MyAccount shows Create New Secret, Upgrade, and Delete to users who have the matching permission. To see who has access to your account, and with which role, see Manage users. See also Create a policy set and Upgrade or Delete is missing.
Can I recover a deleted secret?
Section titled “Can I recover a deleted secret?”No. Deleting removes the store with every value in it, and its address stops working. Copy out anything you need first. See Delete a secret.