A secret is a password, token, key pair, certificate or secure note kept on the equipment, software, service, circuit or client it belongs to. It stays hidden until someone allowed to see it clicks Show, and every time one is shown or copied is recorded.

Overview

Where secrets appear

Once an Admin turns on the Vault, a Secrets panel appears on these pages:

• a piece of equipment
• a software product, on Software
• a service
• a circuit
• a client, when your company manages clients

A secret that belongs to the company rather than one record, such as a shared Wi-Fi passphrase, is added on the Vault page instead.

Anyone who can open the record sees that a secret is there, its label and its kind. People without See secrets and config backups see "Your role cannot see secrets. Ask an Admin." and nothing more. People with it also see the username, when it expires and its notes, and can show and copy the secret itself.

The five kinds

Kind	Fields	Hidden until Show
Password	Label, Username, Password, Notes	Password
Token or API key	Label, Username, Token, Expires, Notes	Token
Key pair	Label, Private key, Passphrase, Public key, Notes	Private key and passphrase
Certificate	Label, Private key, Passphrase, Certificate and chain, Expires, Notes	Private key and passphrase
Secure note	Label, Note, Notes	Note

• Label names the secret, such as "BIOS password", "local admin" or "enable secret". It is required.
• Public key and Certificate and chain are not secret. They show without Show when you open the secret on the Vault page.
• Notes are not secret either: where it is used, who to ask. Keep secret text in the secret itself.
• A token's or certificate's Expires date puts it on the Renewals calendar.

The Vault page

In the sidebar, open Documentation, then Vault. It lists every secret with:

• Label, with its kind and, for people who can see secrets, its username
• Used on: the records it is on (equipment by its tag), or The company
• Changed: when it was last changed, and "Rotated" with a date when it was marked rotated
• Last shown: when and by whom, or Never

Search by label, or filter by Kind or Shown by, last 90 days. Each row has icon buttons for Open, Edit, Mark rotated and Delete; point at one to see its name. Open shows the secret, the public key or certificate, the records it is Used on, and its Earlier values.

Requirements

• Role: See secrets and config backups to show and copy secrets. Add, edit and delete secrets and config backups to add, edit, mark rotated and delete them. Admin, Manager and Technician have both by default. Changing a secret does not need seeing it: someone can replace a password they cannot read.

Add a secret to a record

1. Open the equipment, software, service, circuit or client.
2. In the Secrets panel, click Add a secret.
3. Choose the Kind.
4. Enter a Label and the fields for that kind.
5. Click Submit.

The secret is saved and put on this record.

Add a secret that belongs to the company

1. In the sidebar, open Documentation, then Vault.
2. Click Add a secret.
3. Fill in the form as above and save it.

Used on reads The company until you put it on a record.

Use one saved secret on many records

1. Open the record that also uses the secret.
2. In the Secrets panel, click Use a saved secret.
3. Pick the Secret from the list. Each shows its label and kind.
4. Click Submit.

The panel then reads "on 3 records" (or however many) beside the secret. Changing it on any one of them changes it everywhere.

To take a secret off one record, click Remove from here beside it. The secret stays in the Vault and on any other records it is on.

Show or copy a secret

1. Beside the hidden value, click Show. Click Hide to hide it again. It also hides itself after 30 seconds.
2. Or click Copy to put it on your clipboard without showing it. The button reads Copied for a moment.

Confirm it is you

The first time you show or copy a secret, Confirm it is you opens. The check lasts 15 minutes.

• Enter Your password and click Confirm, or
• click Use a passkey instead. Passkeys work on your TekStacks address, not on a custom domain.

If your account has no password but has a passkey, you confirm with the passkey on your TekStacks address; on a custom domain, the dialog links you there. If you sign in only with Microsoft and have no passkey, you are not asked: your company's Microsoft sign in is the check.

Edit a secret

1. On the record's Secrets panel, click Edit, or on the Vault page click the Edit icon.
2. Change what you need. The Kind cannot be changed.
3. Leave the secret fields blank to keep what is stored, or enter a new value to replace it.
4. Save.

When the secret is on more than one record, the confirmation says "It changed on every record it is on."

Put an earlier value back

The last 10 values of each secret are kept, encrypted, so a mistaken change can be undone.

1. On the Vault page, click the Open icon on the secret.
2. Under Earlier values, each one shows when it was replaced. Use Show or Copy to check it.
3. Click Put this value back, then Put it back.

The current value becomes an earlier value in turn.

When someone leaves

Change the secrets the person saw, since anything shown could have been copied.

1. On the Vault page, open the filter Shown by, last 90 days and pick the person.
2. For each secret listed, change it where it is used, then click the Edit icon and enter the new value.
3. Click the Mark rotated icon and confirm.

Mark rotated records that it was changed where it is used. The Changed column then shows "Rotated" with the date.

Delete a secret

1. On the Vault page, click the Delete icon on the secret.
2. Confirm.

It and its earlier values are gone from every record it is on. The activity log keeps that it existed, never its value.

History

What happens to a secret is written to the history of each piece of equipment it is on, with its kind and label, never its value. For example:

• "Secret (Password) - BIOS password added"
• changed, removed, put back to an earlier value, or deleted from the Vault

Every time a secret is shown or copied is recorded in the activity log.

Tokens and certificates on Renewals

A token or certificate with an Expires date appears on Renewals as Tokens and certificates, showing "Expires:" and its label. Clicking it opens the Vault page, searched for its label. Only people with See secrets and config backups see these entries, and they never go into the calendar feed.

Notes

Note: Secrets follow the client you are working in. In the all clients view, pick a client before adding a secret on the Vault page. A saved secret can only be used on records of the same client.

Note: When your company uses its own key, the add and edit form names the secret field Secret, and to change a passphrase you enter the private key again too. Adding and editing need a trusted browser.

Note: Copy does not clear your clipboard afterward. Paste the secret where it is needed and copy something else over it.

Troubleshooting

"Your role cannot see secrets. Ask an Admin." Your role does not have See secrets and config backups. An Admin can give it on Roles.

"You have shown a lot of secrets in the last hour. Try again later." Showing secrets is limited per person per hour. Wait and try again. Admins are emailed when someone shows an unusual number.

"That secret belongs to another client." A secret can only be used on records of the client it was added to.

There is no Secrets panel on the page. The Vault is off. An Admin turns it on under Administration, Vault settings.

FAQ

Can I keep my own logins in the Vault? No. The Vault is for secrets that belong to your company's equipment and systems. Keep people's own logins to websites and online services in a password manager.

Are secrets in the data export? No. Secret values never appear in the data export, emails or logs. An Admin can make a separate encrypted copy of every secret: see Exporting the Vault.