Secrets overview
Secrets store configuration values a site or app needs at runtime — connection strings, integration tokens, feature configuration — outside application code. Each secret follows a secret type that defines its validation schema and its sensitivity level, and each value is scoped to a site or to one app within that site.
How secrets are organized
A secret belongs to a site, and optionally to one app within that site. The request hostname selects the site; an app slug selects the app.
A site secret is shared across every app in the site. An app secret belongs to one app. When a key exists at both levels, the app value takes precedence over the site value. See Secrets concepts for the resolution rules.
What you can manage
| Capability | What it gives you | Start here |
|---|---|---|
| Secret types | Named definitions with a JSON validation schema and a fixed sensitivity level | Secrets concepts |
| Site and app secrets | Key-value configuration scoped to a site, or to one app with precedence over the site | Secrets concepts |
| Sensitivity levels | Per-type public, private, or sensitive classification that controls storage and access | Security and limits |
| Tags | Slug labels for organizing and filtering secrets | Secrets concepts |
| Audit history | Metadata change records that exclude the secret value | Secrets concepts |
Sensitivity levels
A secret type carries one sensitivity level, fixed when the type is created. The level controls how the value is stored and who can read it.
| Level | Storage | Read access |
|---|---|---|
public | Plaintext | Readable without authentication on single‑secret and batch reads |
private | Encrypted database field | Authenticated callers with site or app access |
sensitive | Encrypted database field | The most restricted tier; see the access model |
Read access also depends on the endpoint (single‑secret, batch, list, or history), not the sensitivity level alone. Security and limits describes the access model per endpoint.
Choose an interface
| Interface | Coverage | Notes |
|---|---|---|
| TaruviBase Console | Full management | Create and manage secret types, site secrets, and app secrets |
| JavaScript SDK | Runtime reads (get, list) | Returns the SDK response wrappers |
| Python SDK | Runtime reads (get, list) | get extracts one secret; list retains the response wrapper |
These guides use JavaScript SDK 1.5.3 and Python SDK 0.2.1. See Read secrets from an SDK for the response each SDK returns.
Use Console for management. Select the site Secrets tab for shared values, or open an app and choose Operate → Secrets for app-owned values. Secret types are in site Settings under Secret Types. The runtime reference covers reading secrets from the SDKs.
Keep in mind
- Never print secret values in logs.
- Store credentials as secrets, not as ordinary site settings.
- A deleted secret can't be recovered, so keep a copy of any value you may need.