AvailableConfiguration that never ships inside a build.
Keep database URLs, provider keys and webhook secrets in an encrypted, per-application store. Set them from the console; read them from your backend with the application’s client secret. The console can list and delete, but never reveal.
read at runtime · your backend
curl https://auth.api.devsewa.com/v1/secrets/DATABASE_URL \
-H "Authorization: Bearer $DEVSEWA_CLIENT_SECRET"
{ "name": "DATABASE_URL", "value": "postgres://…" }What you get
Secret Store, without running it.
Served from auth.api.devsewa.com/v1/secrets and managed from the console. Backed by devsewa-authority-core, mediated by the DevSewa control plane.
- Environment-variable-shaped names, encrypted values
- Encrypted with a key dedicated to customer secrets
- Reveal only via the owning backend’s client secret
- Overwrite in place; delete is immediate
- Separate from DevSewa’s own identity secrets by design
- Set and delete events in the audit log
Isolation
How it stays yours.
- Scope
- Secrets belong to one application; the key resolves which
- Console
- List, set, delete — reveal is deliberately not available
- Storage
- AES-256-GCM per value, feature-specific key
Add Secret Store to your application.
Create an account, register a test application and exchange your first ticket in under ten minutes.