When your company holds its own Vault key, secrets open only in browsers trusted with that key. Each person's browser is approved once, by someone already trusted or with the recovery key, and then works on every visit without asking again.

Overview

This page applies only when an Admin turned the Vault on with Use your own key. With TekStacks' key, there are no trusted browsers: your role's permissions are enough. See Turning on the Vault.

With your own key, the company's key never reaches TekStacks. It is kept in your trusted browsers, each holding it locked with a key of its own that cannot be read out of the browser, and in the recovery key your Admin saved. Secrets are encrypted and opened in the browser, so TekStacks stores only what it cannot read.

The Admin who turned the Vault on has the first trusted browser. Everyone else asks for access once per browser.

A trusted browser belongs to one person on one address:

• Each address is a separate browser. Your TekStacks address, such as yourcompany.tekstacks.com, and your custom domain are two trusted browsers, each approved once. If your team always uses one address, approve only that one.
• Clearing the browser's data forgets its key. The browser then asks for access again.
• Each person approves their own. Two people sharing a computer each ask for access.

Requirements

• Role: See secrets and config backups. Only people with it can ask for access, approve a colleague or use the recovery key.

Ask for access

1. Open the Vault page, or a record with a Secrets or Config backups panel.
2. The panel reads "This browser is not trusted with your company's vault key yet." Click Ask for access.
3. It now reads "This browser asked for access." Tell a colleague who is already trusted.

Once approved, reload the page. Secrets open from then on.

Approve a colleague's browser

1. Open the Vault page in your own trusted browser.
2. Under Waiting for access, find the person. Each request shows their name, the browser and address, such as "Chrome on Windows, yourcompany.tekstacks.com", and when they asked.
3. Click Trust this browser.

Note: Trust only a browser you know is theirs: it can then show every secret their role allows. If you did not expect the request, check with the person first.

Use the recovery key

Use it when nobody trusted is available, or when every trusted browser is lost.

1. Open the Vault page, or a record with a Secrets panel.
2. Enter the key in Recovery key.
3. Click Use the recovery key.

This browser is trusted at once. Any requests under Waiting for access then appear for you to approve.

Notes

Note: Removing See secrets and config backups from someone's role cuts off every browser they had trusted. If they get it back, they ask for access again.

Note: With your own key, adding and editing secrets and saving config copies also happen in a trusted browser, so they need See secrets and config backups as well as Add, edit and delete secrets and config backups.

Note: Approving a browser does not skip the check that it is you. Showing a secret still asks for your password or passkey first. See Secrets.

Note: If every trusted browser is lost and nobody has the recovery key, nobody can open the secrets, TekStacks included.

Troubleshooting

"This browser could not open the vault key. Ask for access again." The browser's saved key no longer works. Click Ask for access.

"That recovery key did not open the vault." Check the key was copied in full, with no spaces before or after it.

The panel says "This browser is not trusted" on our custom domain, but it works on the TekStacks address. Each address is a separate trusted browser. Ask for access on the custom domain too.

I was trusted yesterday and now I am asked again. The browser's data was cleared, you are on a different address, or your role lost See secrets and config backups.

"This browser is not trusted with the vault key yet." beside a secret. Secrets open only in a trusted browser. Ask for access, or use the recovery key.

The Save button stays grayed out when adding a secret. The form reads "This browser needs to be trusted with your company's vault key first." Ask for access, or use the recovery key.

FAQ

Do I approve my browser every time I sign in? No. Once per browser, per address.

Can TekStacks approve a browser for us? No. Only someone already trusted, or the recovery key, can let a browser in.