Secrets Providers

Skitflow integrates with industry-leading secret management solutions, allowing you to securely store and inject sensitive data into your applications without hardcoding credentials.

Supported Providers

AWS Secrets Manager

Store and retrieve secrets from AWS Secrets Manager.

Configuration:

• Region — AWS region (e.g., us-east-1)
• Access Key ID — IAM access key with secretsmanager:GetSecretValue permission
• Secret Access Key — Corresponding secret key

IAM Policy (minimum):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["secretsmanager:GetSecretValue"],
      "Resource": "arn:aws:secretsmanager:*:*:secret:skitflow/*"
    }
  ]
}

HashiCorp Vault

Connect to a HashiCorp Vault instance for centralized secret management.

Configuration:

• Vault URL — Your Vault server address (e.g., https://vault.example.com)
• Token — Vault authentication token
• Secret Path — Base path for secrets (e.g., secret/data/skitflow)
• Namespace — (Optional) Vault namespace for enterprise deployments

Azure Key Vault

Retrieve secrets from Azure Key Vault using Azure AD authentication.

Configuration:

• Vault URL — https://{vault-name}.vault.azure.net
• Tenant ID — Azure AD tenant ID
• Client ID — Application (client) ID
• Client Secret — Application client secret

Google Secret Manager

Access secrets stored in Google Cloud Secret Manager.

Configuration:

• Project ID — Google Cloud project ID
• Service Account Key — JSON key file for a service account with roles/secretmanager.secretAccessor

Using Secrets in Services

Once a provider is configured, reference its secrets in your environment variables with a template placeholder:

{{secret.ProviderName.key}}

• ProviderName — the name you gave the secret provider when you configured it.
• key — the secret's key within that provider.

For example:

DATABASE_PASSWORD={{secret.Production.db-password}}
API_KEY={{secret.AWS.api-key}}

Placeholders are resolved at deployment time; the resolved values are never stored in Skitflow's database.

Best Practices

• Use separate secret paths per environment (production, staging, development)
• Rotate secrets regularly — Skitflow will fetch the latest value on each deployment
• Apply least-privilege permissions to service accounts
• Enable audit logging on your secret provider for compliance