Manage credentials in Secrets Vault

Keep credentials in the supported credential-management workflow.

Use Secrets in Operations for credential records in the vault workflow. The page requires an Admin-level organization role and the relevant area and feature access.

Create a secret record

  1. Open Secrets and use the create action to open New Secret.
  2. Enter a Secret Name and choose a category. Use the description to identify the purpose and responsible operator without repeating the secret value.
  3. Add tags or a Rotation Reminder when useful.
  4. Enter the value for the relevant environment: Development, Staging, or Production. At least one environment needs a value to save.
  5. Choose Save Secret and confirm the record appears in Secrets.

The form normalizes the name to lowercase and replaces spaces with underscores. Check the saved name before referring to it from another workflow.

Review or rotate an environment value

Open the secret record and select the intended environment. Use its reveal control only when you need the current value. The detail view also offers the current version and recent-version information.

Choose Rotate Value to add a new version for that environment, enter the replacement, and save it. Review the resulting version. Adding a missing environment value is a separate Add Value action.

A rotation reminder is not automatic provider-side credential rotation. Saving a new vault value does not prove that the external provider issued it or that every consumer is using it. Coordinate the provider change and verify the dependent integrations or workflows through their own controls.

Keep credential changes traceable

Use nonsecret descriptions and tags to identify the owner and purpose. Record operational follow-up without copying values into tasks, notes, screenshots, or support messages. Inspect the available access-log controls when investigating vault use; do not assume they describe every provider-side action.

Read Delete Secret carefully before removing a record used by other work. Removing the vault record is not a documented way to revoke the corresponding credential at the external provider.