Secrets
Where API keys and tokens live, and how to rotate them.
No secret value is ever written to ~/.clawops/config.json or to a plan file. Both hold
$secret:<NAME> references, resolved at apply time, so a plan can be committed and put in a
pull request.
Where a value can come from
| Source | Where the value lives |
|---|---|
paste | ~/.clawops/secrets/<NAME> on your machine, mode 0600 |
env | your environment, read at apply time, the overlay records only the variable name |
file | a path you already have; the overlay records the path |
The secrets directory itself is 0700. clawops also generates and stores one secret of its own:
the Pulumi state passphrase, at ~/.clawops/secrets/pulumi-passphrase. Setting
PULUMI_CONFIG_PASSPHRASE yourself takes precedence.
Cloud secret managers are recognised, not resolved
aws-sm, aws-ssm, gcp-sm and azure-kv references are understood in plan files but are not
fetched for you yet. clawops warns and leaves the reference in place for you to handle.
Commands
clawops secret list # names and sources, never values
clawops secret set ANTHROPIC_API_KEY
clawops secret rotate ANTHROPIC_API_KEY --stack prod
clawops secret delete ANTHROPIC_API_KEY
clawops secret audit # permissions, orphans, stalenesslist and audit never print a value.
Rotating
rotate updates the value and re-applies the overlay in one step, then you check the result:
clawops secret rotate ANTHROPIC_API_KEY --stack prod
clawops status --stack prod
clawops logs --tail 20 --stack prodThe gateway token rotates the same way and restarts the gateway as part of it.
What is not automated
Cloud secret manager rotation happens in that cloud's console; clawops re-reads the reference
at the next apply. SSH key rotation is ssh-keygen plus clawops init --key-path. Pulumi
state encryption keys belong to your backend.
In logs
Secret values are redacted from logs and from the audit trail:
Authorization, anything matching *token*, *secret*, *key* (except keyName and
keyPath), password and connectionString. See Security for what that
covers and what it does not.