Introducing GitOps Vault

Today we are launching GitOps Vault: secret management that stays close to the projects, Git history, and deployment workflows your team already uses.

Vault gives every project a secure place for environment variables, credentials, and service configuration. It is designed for the practical work around shipping software: keep values organized, control access, and provide them to an application or CI job only when it needs them.

One place for project secrets

Vault stores secrets at the project level and organizes them into folders such as /database, /integrations, or /services/payments. Each secret has a key, an optional description, and values for the environments where it is used.

The platform applies project-scoped permissions for reading, creating, updating, deleting, and exporting secrets. Metadata changes are also tracked through GitDB for a clear audit history.

Environment-aware by default

The same key can hold a different value for development, staging, and production. This lets application code keep stable configuration names while the deployment environment selects the appropriate value.

Folders and environment slugs are used consistently across the Vault UI, API, and CLI. A deployment that requests /database in production gets only that scoped configuration.

Deliver secrets without secret files

The GitOps CLI can inject Vault secrets directly into a command:

gops vault run 
	--api-url https://cloud.getgitops.com/api 
	--api-key "$GOPS_API_KEY" 
	--project-id "$GOPS_PROJECT_ID" 
	--path / 
	--env production 
	-- npm run deploy

The command makes secrets available only to the child process. This works locally and in CI, without committing a .env file or leaving one behind in the workspace.

Get started with Vault

Open Vault in a project to create environments, folders, and secrets. Then read the Vault guide, browse the API definition, or choose a framework integration to connect your application.