Skip to content
Docs

Secrets

On this page
  1. Which sensors use secrets
  2. Create a secret
  3. Use a secret in a sensor
  4. Update and delete
  5. Connection string examples
  6. How secrets are protected

A secret stores a connection string — the address, user and password a sensor needs to reach a database, a Redis store or a RabbitMQ broker. Secrets belong to an environment, are encrypted as soon as they are saved, and are never displayed again: not to you, not to your team.

Secrets require an Enterprise plan and are managed by Managers and Admins.

Which sensors use secrets#

Secret type Sensor
PostgreSQL, SqlServer, MySQL, MariaDB, Oracle SQL database
Redis Key-value store
RabbitMQ Dead-letter queue

Create a secret#

  1. Open Configuration → Environments and select the environment.
  2. In the Secrets card, click New secret.
  3. Fill in:
    • Code — lowercase letters, digits, hyphens and dots, unique in the environment, for example pg-orders-readonly. Sensors refer to the secret by this code.
    • Type — what it connects to. It cannot be changed afterwards.
    • Value — the connection string (examples below).
  4. Save. The value is encrypted at once.
Secrets of the Production environment: codes such as pg-orders-readonly and redis-sessions, their type (PostgreSQL, RabbitMQ, Redis) and version; the value column is always masked.
Secrets show their code, type and version, never their value.

Use a secret in a sensor#

In a SQL, Key-value or Dead-letter queue sensor, the connection section has a Secret selector. It lists the secrets of the sensor's environment with a compatible type, as [Type] code. If none exists, Configure secrets leads to the environment.

Choosing a secret requires the Manager role. A sensor that uses pg-orders-readonly in Staging and the same code in Production connects to two different databases: create the secret with the same code in each environment.

Update and delete#

  • Update value stores a new version (v2, v3…). Sensors use the latest version from their next check.
  • Delete all versions removes the secret. It is refused while an active sensor of the environment uses it: change or delete that sensor first.

Connection string examples#

Use a dedicated, read-only account: the agent only needs to connect and read.

Server=127.0.0.1;Port=5432;Database=myDataBase;User Id=myUsername;Password=myPassword;
Server=myServerAddress;Database=myDataBase;User Id=myUsername;Password=myPassword;
Server=127.0.0.1;Port=3306;Database=myDataBase;User Id=myUsername;Password=myPassword;
Server=127.0.0.1;Port=3306;Database=myDataBase;User Id=myUsername;Password=myPassword;
Data Source=myOracleDB;User Id=myUsername;Password=myPassword;
redis0:6380,password=myPassword,ssl=True,abortConnect=False

Redis configuration options

amqp://user:password@host:port/vhost

AMQP URI specification

How secrets are protected#

Secrets are encrypted with a key unique to your organization, and only decrypted when a check needs them, to be sent to the agent that runs it over its encrypted connection. See Secret security.