Vault

Vault keeps application secrets in one project-scoped store. Organize them into environments and folders, then consume them from the GitOps CLI or API without adding secret files to your repository.

Environments

Environments keep values isolated across deployments. A secret can have a different value in development, staging, and production, while retaining the same key and folder location.

Create and manage environments in your project’s Vault settings. The CLI and API select an environment with its slug, for example --env production.

Folders

Folders organize secrets by path. Use the root path / for values shared by the application, or group them by concern:

/
├── database
├── integrations
└── services/payments

Pass the folder path to the CLI or API with --path /database or path=/database. A request only resolves secrets in its selected path.

Secrets

Each secret has a key, optional description, and a value per environment. Examples include DATABASE_URL, STRIPE_API_KEY, and JWT_SECRET.

Create a secret through the CLI:

gops vault secret create 
	--api-url https://cloud.getgitops.com/api 
	--api-key "$GOPS_API_KEY" 
	--project-id 00000000-0000-0000-0000-000000000000 
	--path /database 
	--key DATABASE_URL 
	--env production 
	--value "$DATABASE_URL"

Use gops vault secret get, update, or delete with the same project, path, and key to manage an existing secret.

Use Vault from the CLI

Install the CLI first:

npm install --global @getgitops/cli

Run an application with its Vault secrets injected as environment variables:

gops vault run 
	--api-url https://cloud.getgitops.com/api 
	--api-key "$GOPS_API_KEY" 
	--project-id 00000000-0000-0000-0000-000000000000 
	--path / 
	--env production 
	-- npm run start

Export a folder’s secrets as an .env or JSON file when a process requires a file:

gops vault export 
	--api-url https://cloud.getgitops.com/api 
	--api-key "$GOPS_API_KEY" 
	--project-id 00000000-0000-0000-0000-000000000000 
	--path /database 
	--env production 
	--format env 
	--output .env.production

Do not commit exported files or API keys to version control.

Use Vault from the API

Vault’s API accepts a project-scoped API key with the required Vault permission. Send it using Authorization: Bearer <api-key>.

Export the secrets in one path and environment:

curl --request GET 
	--header "Authorization: Bearer $GOPS_API_KEY" 
	"https://cloud.getgitops.com/api/vault/export?projectId=00000000-0000-0000-0000-000000000000&env=production&path=/database&format=env"

Create a secret with values for one or more environments:

curl --request POST https://cloud.getgitops.com/api/vault/secret 
	--header "Authorization: Bearer $GOPS_API_KEY" 
	--header "Content-Type: application/json" 
	--data '{
		"projectId": "00000000-0000-0000-0000-000000000000",
		"path": "/database",
		"key": "DATABASE_URL",
		"values": { "production": "postgres://..." }
	}'

Read, update, or delete an individual secret at /api/vault/secret/:key. Include projectId and path as query parameters. Updates require an environment and value in the JSON body.