External secret managers

Configure a provider

Operators configure HashiCorp Vault / OpenBao KV v2 or AWS Secrets Manager under Settings → Integrations. Provider credentials are encrypted and covered by master-key rotation. Infisical and Doppler references continue to work.

DATABASE_PASSWORD=${{vault:apps/api#password}}
API_TOKEN=${{aws:production/api#token}}

Deployment behavior

• Each distinct Vault path or AWS secret is fetched once per deploy, passed to the container and never stored as a resolved value.
• The provider's workspace allowlist controls which services may use references.
• PR previews withhold references and preview-only environment values refuse them.
• When a provider is absent or disabled, its reference stays literal and the deploy log warns using env key names. Configure the provider before relying on resolution.