Skip to main content
The vault group is Voyant’s secrets manager and encryption service. Use it to store application secrets such as API keys and connection strings, and to perform per-call envelope cryptography without managing your own key material.

Secrets

A vault is a named container of secrets, addressed by a slug such as production. Each secret is a key with one or more versions.
You can also manage secrets from the terminal with the CLI:
The CLI can list and write secrets but cannot read their values — there is no voyant secrets get. voyant login mints tokens without the vault:read scope that getSecret, decrypt, and unwrap require. Read a value in the dashboard, or from server-side code with an app token that carries vault:read.

Envelope encryption

The vault performs envelope crypto so you can encrypt data with managed keys. Generate a data key, use the plaintext key locally, store only the wrapped key, and unwrap it when you need to decrypt.

Scopes

Key types: VaultSummary, VaultSecretSummary, VaultSecretValue, VaultEncryptResult, VaultDecryptResult, VaultGenerateDataKeyResult, VaultUnwrapResult.
On Voyant, application secrets live in the vault instead of local .env files. The runtime reads them at deploy time.