Secret access
The key that keeps your secrets locked, and how to get back in.
Read this one properly. It is short, and it is the only page in this guide describing something nobody can fix for you afterwards.
Your secrets are locked. The thing that unlocks them is a key, and cloud does not keep a copy of it. That is deliberate — it is what stops cloud being able to read your secrets — and it has an unavoidable consequence: if the key is ever lost, cloud cannot hand it back. Every secret on that stage becomes unreadable and has to be set again from scratch.
The recovery checklist: a red shield with the heading "Nobody can recover this stage's secrets", the current key's identifier below it, and a button reading "Rotate and show me the key".
The checklist at the top is the whole page
It says one of three things.
| What it says | What it means |
|---|---|
| No key yet | Nothing to save. The stage's first deploy creates one — come back afterwards. |
| Nobody can recover this | Nobody holds a copy. This is the state to fix, today. |
| You have a recovery copy | Someone confirmed they saved a copy of the key in use right now. |
The dangerous state is the middle one, and the reason it is dangerous is that it looks completely normal. A stage nobody can recover serves traffic, deploys, and behaves perfectly — right up until the day it does not.
Taking a copy
Press Rotate and show me the key. It issues a fresh key and shows it to you once.
Once is literal. Close that panel without saving it and it is gone — cloud kept nothing. Copy it into a password manager, or wherever your team keeps things it genuinely cannot lose.
Rotating is safe for the secrets you have already set: they are carried over to the new key, so nothing needs setting up again. If any value cannot be carried across, the confirmation tells you exactly which, before you commit.
Closing the panel and confirming you saved it are two separate actions on purpose. Closing without confirming leaves the warning standing — which is the honest reading of "they might not have saved it".
Putting a saved key back
If a stage has lost its key and you have your copy, paste it into Restore a saved key. It is accepted only if it matches the key that stage is already using, so it can repair a stage and can never be used to take one over.
Rotating issues a different key. The copy you saved before will not open anything sealed with the new one, so save the new copy too. The warning re-arms itself every time the key changes, which is why it may reappear after you were sure you had dealt with it.