'%20stroke='url(%23em)'/%3e%3cellipse%20cx='30'%20cy='34'%20rx='26'%20ry='20'%20fill='url(%23gm)'/%3e%3cpath%20d='M12.5%2013.00L52.5%2021.74L52.5%2024.33L12.5%2017.60Z'%20fill='url(%23lm)'/%3e%3crect%20x='14.20'%20y='19.29'%20width='6.60'%20height='28.93'%20rx='1.45'%20fill='url(%23cm0)'/%3e%3crect%20x='27.00'%20y='21.24'%20width='5.60'%20height='24.81'%20rx='1.23'%20fill='url(%23cm1)'/%3e%3crect%20x='37.60'%20y='22.85'%20width='4.70'%20height='21.42'%20rx='1.03'%20fill='url(%23cm2)'/%3e%3crect%20x='46.60'%20y='24.22'%20width='4.00'%20height='18.53'%20rx='0.88'%20fill='url(%23cm3)'/%3e%3cpath%20d='M12.5%2050.00L52.5%2042.57L52.5%2044.26L12.5%2053.00Z'%20fill='%237fa3ff'%20opacity='.75'/%3e%3c/svg%3e)
PorticolShared secrets
In a workspace on Porticol Cloud or a team server, an environment's secret values can be shared with the workspace's members. They are encrypted on the desktop before they sync, so the server stores only what it can't open.
How it works
- Each desktop you sign in to makes its own key pair and keeps it in the keychain.
- A workspace has a key, which is kept encrypted for each device that may read it.
- Secret values are encrypted under the workspace's key on the desktop that saves them, bound to the workspace, environment and variable they belong to.
- The server stores public keys, encrypted keys and encrypted values, and no key that opens any of them.
- When a member leaves or a device is signed out, the next desktop that holds the key replaces it and encrypts every value again, so the removed device reads nothing written afterwards.
Share a secret
Turn on Shared on an environment in a server workspace. The first time you share a secret, if your account has no recovery key, Porticol asks you to make one first.
Your recovery key
A recovery key opens your account's shared secrets on a new device. It is shown once and Porticol keeps no copy, so write it down and keep it somewhere safe. A secret that no device or recovery key holds is lost for good: nobody can recover it, Porticol included.
To use it on a new device, choose Use recovery key in Settings > Account and type it in.
Approve a new device
A desktop you sign in to on a new computer can't read shared secrets until one of your other desktops approves it. The new device shows a code. On a desktop you already use, open Settings > Account, find the new device under shared secrets and type the code.
For administrators
If a member loses a device, sign that device out, or remove the member. The workspace's keys are then replaced, and the lost device can't read anything written after that. Shared secrets are in some plans and not others; pricing lists them.
The desktop can also read a variable's value from HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or Google Secret Manager as it sends, with credentials kept in its keychain; see Sending requests.