Docs Not Found Page not found

Server Keys

Server keys allow automation and services to authenticate with GitOps without using a person’s password. Treat them as credentials and grant only the access required by the integration.

What server keys are

A server key is a non-interactive credential for API or automation access. It should belong to the organization or project that owns the workload it serves, rather than to an individual developer.

Create a key

Create the key in the relevant access-management area, assign its minimum required role, and copy the secret when it is shown. Store it in a secret manager and inject it into the workload at runtime.

Never commit a server key to GitDB, a Docker image, or source control. Do not place it in client-side code.

Rotate keys regularly and immediately when a key may have been exposed. Create the replacement first, deploy it, verify the workload, and then revoke the old key. Keep an inventory of the service, owner, scope, and expiry for each key.