Manage secrets in TaruviBase Console

Use TaruviBase Console for secret-type and secret management. Scope is selected by where you open Secrets: site for shared fallback values, or app for values owned by one application. The SDKs do not expose create, edit, delete, or history operations.

Console locations

Select scope before opening the create dialog; Console has no scope field:

Task	Console location
Manage site secrets	Select the site Secrets tab
Manage app secrets	Open the app, then choose Operate → Secrets
Manage secret types	Select site Settings → Secret Types

The app page sends the app slug and lists with scope=app; it does not show inherited site secrets. SDK reads with an app slug still use app-over-site fallback.

Prerequisites

• a non-production site and, for app scope, the intended app;
• a Console account with access to that site; and
• a copy of any value you may delete.

Create a secret type

1. Open site Settings and select Secret Types.
2. Select Create Secret Type, or Create Your First Secret Type in an empty list.
3. In Create New Secret Type, complete Name, Description, and Sensitivity Level.
4. Under Define Secret Schema, use Add Field to add at least one field and mark required fields deliberately.
5. Select Create Secret Type.

Sensitivity is immutable. On edit, Edit Secret Type shows it as read-only; change only the name, description, or schema and select Save Changes.

The type name must match ^[a-zA-Z0-9_-]+$ and is limited to 100 characters. Console requires at least one schema field.

Create a secret

1. Open the site or app Secrets page for the intended scope.
2. Select Create Secret.
3. In Create New Secret, complete Key, Secret Type, and the dynamic <type name> Configuration fields. Add Tags (optional) only when needed.
4. Select Create Secret.

The API schema caps keys at 255 characters. Console is narrower and currently accepts only letters, numbers, _, and - in Key. A key must be unique within its site or app scope.

If creating a secret fails because of a tag, the secret may still have been created. Search for the key before selecting Create Secret again, and edit the existing secret instead.

Inspect a secret in Console

The Secrets page supports Search secrets..., Refresh, card/list views, and masked value previews. Select a card or row to open the detail dialog. Show, Copy, and Copy all values expose plaintext; use them only when no one else can see your screen, and never paste values into logs or tickets.

Edit a secret

1. Return to the same site/app Secrets page used to create it.
2. Use the card Edit action, the list Edit Secret action, or select the item and choose Edit.
3. In Edit Secret, update tags or configuration fields. Key is disabled and shows “Key cannot be changed after creation.”
4. Select Save Changes, then reopen the detail dialog to verify the value.

Console preserves the current scope and resends the complete saved definition. The key cannot be renamed; create a replacement key and migrate consumers when the identifier must change.

Delete a secret

Deleting a secret is permanent

The value is not recoverable from TaruviBase after deletion.

Before using Delete:

1. Affected resource and cascade — confirm site/app location and key. A site deletion affects apps that rely on fallback.
2. Reversibility — there is no soft delete or undo.
3. Authorization — anyone with access to the site can delete secrets; confirm you are on the right site.
4. Backup — place any required value in an approved secret store.
5. Confirmation — open the detail dialog and verify scope and key.
6. Success and postcondition — choose Delete, then in Delete Secret choose Delete and confirm the row disappears after Refresh.
7. Recovery — recreate from the approved backup if necessary.

Delete a secret type

Deleting a secret type is permanent

The backend rejects deletion while a secret uses the type, and system types cannot be deleted.

Before using Delete Secret Type:

1. Affected resource and cascade — remove or migrate every referencing secret first.
2. Reversibility — the type schema has no restore operation.
3. Authorization — anyone with access to the site can delete secret types; confirm you are on the right site.
4. Backup — record the schema in an approved store.
5. Confirmation — in site Settings → Secret Types, verify the card's name and sensitivity.
6. Success and postcondition — select the card delete action, then choose Delete Secret Type and confirm it leaves the list.
7. Recovery — recreate the type and required secrets from approved backups.

Metadata history is not available through Console or the SDKs.

Troubleshoot

See Troubleshoot secrets for scope, validation, cache, and Console-action failures.

For application reads, continue with Read secrets from an SDK.