Identity and security
Secrets and integrations
Encrypted secret versions, credential-injecting integration bindings, approvals, and rotation.
v1 design baseline. This page specifies intended behavior. Delivery and validation are tracked in the implementation plan; it is not a claim that the platform is already implemented.
Secret lifecycle
Each secret has:
organization
application/environment scope
name
type
encrypted versions
created by
rotated by
last used
expiration
approval status
Secrets never appear in:
- Source control
- Build environment
- Build logs
- AI tool output
- Audit payloads
- Client-side Nuxt bundles
Preferred integration object
Provide approved integration choices instead of asking an app creator to enter arbitrary environment variables:
Integration: Accounting API
Destination: https://api.example.com
Auth: OAuth client credential
Allowed methods: GET, POST
Allowed paths: /invoices/*
Applications: Equipment Requests
Environment: production
The app receives a typed binding.
AI behavior
AI can:
- Request an integration by type
- Generate code using its documented schema
- Reference the binding name
- Explain why it is needed
AI cannot:
- Read the credential
- Change its destination
- Broaden allowed paths
- Attach it to another app
- Approve it
Rotation
Rotating an integration credential should not require rebuilding the app.
The binding resolves the active secret version at runtime.