Skip to content
Go to dashboard

8.2Create a secret

In the dashboard#

  1. Select secrets in the top bar. The page is part of the secrets & discovery section.
  2. Select new secret. If your team has no secrets yet, select + add a secret.
  3. In name, enter a name such as PROD_API_TOKEN. The box changes letters to capitals as you type. It drops any character other than A–Z, 0–9 and _.
  4. In value, paste the secret value. The box hides what you type.
  5. In allowed sites, enter the sites that may receive the secret, one per line, such as app.example.com. See 8.4 for the rules.
  6. Select encrypt & store →. The button works only when the name is valid, the value is not empty and at least one site is entered.

A card appears at the top of the page. It has the secret's name and the tag shown once.

  1. Select click to reveal to see the value, or select copy to copy it.
  2. Store the value somewhere safe, such as your password manager.
  3. Tick "I have copied and stored this value — I understand it cannot be shown again."
  4. Select done — dismiss forever.

Rules for each field#

FieldRules
nameStarts with a capital letter. Uses only capital letters, digits and _. 1 to 64 characters. Must be unique in your team.
valueRequired. At most 8 KiB.
allowed sitesRequired. 1 to 20 sites. See 8.4.

Your team can hold up to 200 secrets, unless your team has a different limit.

If something goes wrong#

The dialog shows the error as text. The API returns the same message.

MessageWhat to do
must start with a letter; A–Z, 0–9 and _ only, max 64 (dashboard)
invalid input: name must match [A-Z][A-Z0-9_]{0,63} (API)		Fix the name.
invalid input: value requiredEnter a value.
invalid input: value must be at most 8 KiBUse a shorter value.
secret with this name already existsPick another name, or delete the old secret first.
team secret limit reached: a team can hold at most <N> secrets; delete one it no longer usesDelete a secret you no longer use.

With the API#

Call CreateSecret with an API key (chapter 13). Send the name, the value and the allowed sites:

Create a secret
BASE=https://www.obsrvly.com/api/gw/monitor
API=$BASE/obsrvly.v1.MonitorConfigService

curl -s $API/CreateSecret \
  -H "Authorization: Bearer $OBSRVLY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "PROD_API_TOKEN",
       "value": "<your token>",
       "allowedHosts": ["api.example.com"]}'

The reply contains the secret (with its id, name, createdAt and allowedHosts) and the value. The value is returned this one time only.

  • ListSecrets (send {}) returns your secrets sorted by name. It never returns values.
  • Errors use the codes in chapter 13: a bad field is invalid_argument (400), a taken name is already_exists (409), and the team limit is resource_exhausted (429).

The secrets list#

The list header reads team secrets · <count>. Each row shows:

  • name, with the date it was created, who created it (when known) and its allowed sites,
  • value, always shown as ••••••,
  • used by, the number of monitors that reference the secret.

Select a row to open its details. You see the reference, such as ${PROD_API_TOKEN}, the allowed sites and the monitors that reference it. Each monitor shows the step that uses the secret, such as step 2 · fill input[name=password]. Steps here are counted from 1.

Last updated