Secrets

Secrets are the core resource in FyVault. A secret represents a credential that your application needs.

Secret Types

API Key

For HTTP-based APIs like OpenAI, Stripe, Twilio. FyVault intercepts outbound HTTP requests and injects the key into the specified header.

Injection config:

Field	Description	Example
`target_host`	API hostname	`api.openai.com`
`target_port`	API port (usually 443)	`443`
`header_name`	HTTP header name	`Authorization`
`header_template`	Header value format	`Bearer {{value}}`
`proxy_port`	Local proxy port	`19001`

Your .env change:

.envenv

# Before
OPENAI_API_KEY=sk-proj-real-key

# After
OPENAI_API_KEY=FYVAULT::openai_api_key

Database Credential

For PostgreSQL, MySQL, etc. FyVault runs a transparent protocol-aware proxy with native database protocol support.

Injection config:

Field	Description	Example
`db_type`	Database engine	`postgresql`
`target_host`	Real DB hostname	`mydb.rds.amazonaws.com`
`target_port`	Real DB port	`5432`
`proxy_port`	Local proxy port	`5433`
`username`	DB username	`myapp`
`database`	Database name	`production`

Your .env change:

.envenv

# Before
DATABASE_URL=postgres://myapp:secretpassword@mydb.rds.amazonaws.com:5432/production

# After
DATABASE_URL=postgres://myapp@localhost:5433/production

AWS Credential

For AWS SDKs. Uses the standard credential_process mechanism.

Your ~/.aws/config change:

~/.aws/configini

[profile default]
credential_process = fyvault-shim aws

Generic

For any other secret that you want securely stored and available on your device. No automatic injection — your application reads it via the FyVault CLI or SDK.

Secret Versioning

Every update creates a new version. Previous versions are retained for audit purposes. You can view the version history and roll back to any previous version from the secret detail page.

Encryption Modes

Zero-Knowledge (Client)

Encrypted in your browser. Cloud never sees plaintext. Requires vault passphrase to decrypt. This is the recommended mode.

Server

Encrypted with AWS KMS envelope encryption. Legacy mode — use zero-knowledge for new secrets.