[{"data":1,"prerenderedAt":617},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Fsecret-providers":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":117,"body":141,"description":610,"extension":611,"meta":612,"navigation":613,"path":116,"seo":614,"stem":615,"__hash__":616},"docs\u002Fdocs\u002Fsecret-providers.md",{"type":142,"value":143,"toc":605},"minimark",[144,154,159,171,336,339,408,421,425,432,497,508,511,515,581,588,601],[145,146,147,148,153],"p",{},"For a local project, start with Age: an encrypted store that does not need a\nseparate server. See ",[149,150,152],"a",{"href":151},".\u002Fconcepts\u002Fenvironments-and-secrets","environment values and secrets",".\nUse OpenBao or Vault when your team already has a server, or when you need to\ntest that integration locally.",[155,156,158],"h2",{"id":157},"connect-an-existing-server","Connect an existing server",[145,160,161,162,166,167,170],{},"Give the connection a name, such as ",[163,164,165],"code",{},"team-secrets",", in ",[163,168,169],{},".config\u002Fmm.yaml",":",[172,173,178],"pre",{"className":174,"code":175,"language":176,"meta":177,"style":177},"language-yaml shiki shiki-themes mm","providers:\n  team-secrets:\n    driver: openbao\n    scope: project\n    mode: external\n    address: https:\u002F\u002Fprovider.example.test:8200\n    storage-mount: mm-kv\n    automation-auth-mount: mm-approle\n    trust-bundle: company-ca.pem\n    expected-trust-sha256: sha256:HEX_DIGEST\nsecrets:\n  database.password:\n    storage:\n      provider: team-secrets\n      location: database\u002Fpassword\n","yaml","",[163,179,180,193,201,213,224,235,246,257,268,279,290,298,306,314,325],{"__ignoreMap":177},[181,182,185,189],"span",{"class":183,"line":184},"line",1,[181,186,188],{"class":187},"sWZmh","providers",[181,190,192],{"class":191},"sIbZ0",":\n",[181,194,196,199],{"class":183,"line":195},2,[181,197,198],{"class":187},"  team-secrets",[181,200,192],{"class":191},[181,202,204,207,209],{"class":183,"line":203},3,[181,205,206],{"class":187},"    driver",[181,208,170],{"class":191},[181,210,212],{"class":211},"sv8ni"," openbao\n",[181,214,216,219,221],{"class":183,"line":215},4,[181,217,218],{"class":187},"    scope",[181,220,170],{"class":191},[181,222,223],{"class":211}," project\n",[181,225,227,230,232],{"class":183,"line":226},5,[181,228,229],{"class":187},"    mode",[181,231,170],{"class":191},[181,233,234],{"class":211}," external\n",[181,236,238,241,243],{"class":183,"line":237},6,[181,239,240],{"class":187},"    address",[181,242,170],{"class":191},[181,244,245],{"class":211}," https:\u002F\u002Fprovider.example.test:8200\n",[181,247,249,252,254],{"class":183,"line":248},7,[181,250,251],{"class":187},"    storage-mount",[181,253,170],{"class":191},[181,255,256],{"class":211}," mm-kv\n",[181,258,260,263,265],{"class":183,"line":259},8,[181,261,262],{"class":187},"    automation-auth-mount",[181,264,170],{"class":191},[181,266,267],{"class":211}," mm-approle\n",[181,269,271,274,276],{"class":183,"line":270},9,[181,272,273],{"class":187},"    trust-bundle",[181,275,170],{"class":191},[181,277,278],{"class":211}," company-ca.pem\n",[181,280,282,285,287],{"class":183,"line":281},10,[181,283,284],{"class":187},"    expected-trust-sha256",[181,286,170],{"class":191},[181,288,289],{"class":211}," sha256:HEX_DIGEST\n",[181,291,293,296],{"class":183,"line":292},11,[181,294,295],{"class":187},"secrets",[181,297,192],{"class":191},[181,299,301,304],{"class":183,"line":300},12,[181,302,303],{"class":187},"  database.password",[181,305,192],{"class":191},[181,307,309,312],{"class":183,"line":308},13,[181,310,311],{"class":187},"    storage",[181,313,192],{"class":191},[181,315,317,320,322],{"class":183,"line":316},14,[181,318,319],{"class":187},"      provider",[181,321,170],{"class":191},[181,323,324],{"class":211}," team-secrets\n",[181,326,328,331,333],{"class":183,"line":327},15,[181,329,330],{"class":187},"      location",[181,332,170],{"class":191},[181,334,335],{"class":211}," database\u002Fpassword\n",[145,337,338],{},"Replace the address, trust bundle, and digest with verified server details.\nStore the public trust bundle in the project. Never put tokens, unseal keys, or\nTLS private keys in this file.",[172,340,344],{"className":341,"code":342,"language":343,"meta":177,"style":177},"language-sh shiki shiki-themes mm","mm secret provider add team-secrets --driver openbao --mode external --scope project\nmm secret provider test team-secrets\nmm secret provider status team-secrets\n","sh",[163,345,346,382,395],{"__ignoreMap":177},[181,347,348,352,355,358,361,364,368,371,374,377,380],{"class":183,"line":184},[181,349,351],{"class":350},"svrjQ","mm",[181,353,354],{"class":211}," secret",[181,356,357],{"class":211}," provider",[181,359,360],{"class":211}," add",[181,362,363],{"class":211}," team-secrets",[181,365,367],{"class":366},"sbRf1"," --driver",[181,369,370],{"class":211}," openbao",[181,372,373],{"class":366}," --mode",[181,375,376],{"class":211}," external",[181,378,379],{"class":366}," --scope",[181,381,223],{"class":211},[181,383,384,386,388,390,393],{"class":183,"line":195},[181,385,351],{"class":350},[181,387,354],{"class":211},[181,389,357],{"class":211},[181,391,392],{"class":211}," test",[181,394,324],{"class":211},[181,396,397,399,401,403,406],{"class":183,"line":203},[181,398,351],{"class":350},[181,400,354],{"class":211},[181,402,357],{"class":211},[181,404,405],{"class":211}," status",[181,407,324],{"class":211},[145,409,410,411,415,416,420],{},"Setup asks for credentials through a hidden prompt after showing its plan.\nUse the ",[149,412,414],{"href":413},".\u002Fopenbao","OpenBao"," or ",[149,417,419],{"href":418},".\u002Fvault","Vault"," guide for server requirements\nand bootstrap options.",[155,422,424],{"id":423},"run-a-local-development-server","Run a local development server",[145,426,427,428,431],{},"A ",[163,429,430],{},"managed"," provider is a server mm starts and maintains for you. Declare the\ninstance using the driver guide, then review its installation:",[172,433,435],{"className":341,"code":434,"language":343,"meta":177,"style":177},"mm secret provider plan local-secrets --operation install\nmm secret provider apply local-secrets --operation install --plan PLAN_HASH --yes\nmm secret provider status local-secrets\n",[163,436,437,457,484],{"__ignoreMap":177},[181,438,439,441,443,445,448,451,454],{"class":183,"line":184},[181,440,351],{"class":350},[181,442,354],{"class":211},[181,444,357],{"class":211},[181,446,447],{"class":211}," plan",[181,449,450],{"class":211}," local-secrets",[181,452,453],{"class":366}," --operation",[181,455,456],{"class":211}," install\n",[181,458,459,461,463,465,468,470,472,475,478,481],{"class":183,"line":195},[181,460,351],{"class":350},[181,462,354],{"class":211},[181,464,357],{"class":211},[181,466,467],{"class":211}," apply",[181,469,450],{"class":211},[181,471,453],{"class":366},[181,473,474],{"class":211}," install",[181,476,477],{"class":366}," --plan",[181,479,480],{"class":211}," PLAN_HASH",[181,482,483],{"class":366}," --yes\n",[181,485,486,488,490,492,494],{"class":183,"line":203},[181,487,351],{"class":350},[181,489,354],{"class":211},[181,491,357],{"class":211},[181,493,405],{"class":211},[181,495,496],{"class":211}," local-secrets\n",[145,498,499,500,503,504,507],{},"Replace ",[163,501,502],{},"PLAN_HASH"," with the printed hash. These servers require shared local\ningress and a local Docker Compose or rootless Podman Compose runtime. Swarm\nand remote managed lifecycle operations are unsupported. Rootless Podman also\nneeds a working user namespace and ",[163,505,506],{},"podman unshare",".",[145,509,510],{},"Managed providers are for development, not production high availability or\nautomatic unsealing after a disaster. Each instance has separate data volumes\nand a loopback-only management port.",[155,512,514],{"id":513},"inspect-or-remove","Inspect or remove",[172,516,518],{"className":341,"code":517,"language":343,"meta":177,"style":177},"mm secret provider list\nmm secret provider show local-secrets\nmm secret provider plan local-secrets --operation remove\nmm secret provider remove local-secrets --plan REMOVE_PLAN_HASH --yes\n",[163,519,520,531,544,561],{"__ignoreMap":177},[181,521,522,524,526,528],{"class":183,"line":184},[181,523,351],{"class":350},[181,525,354],{"class":211},[181,527,357],{"class":211},[181,529,530],{"class":211}," list\n",[181,532,533,535,537,539,542],{"class":183,"line":195},[181,534,351],{"class":350},[181,536,354],{"class":211},[181,538,357],{"class":211},[181,540,541],{"class":211}," show",[181,543,496],{"class":211},[181,545,546,548,550,552,554,556,558],{"class":183,"line":203},[181,547,351],{"class":350},[181,549,354],{"class":211},[181,551,357],{"class":211},[181,553,447],{"class":211},[181,555,450],{"class":211},[181,557,453],{"class":366},[181,559,560],{"class":211}," remove\n",[181,562,563,565,567,569,572,574,576,579],{"class":183,"line":215},[181,564,351],{"class":350},[181,566,354],{"class":211},[181,568,357],{"class":211},[181,570,571],{"class":211}," remove",[181,573,450],{"class":211},[181,575,477],{"class":366},[181,577,578],{"class":211}," REMOVE_PLAN_HASH",[181,580,483],{"class":366},[145,582,583,584,587],{},"Removal preserves data by default. Add ",[163,585,586],{},"--purge"," to both removal commands only\nwhen you intend to delete it. Changing a provider's driver or mode requires a\nreviewed replacement, not an in-place edit.",[145,589,590,591,595,596,600],{},"See the ",[149,592,594],{"href":593},".\u002Freference\u002Fcli","CLI reference"," for backup and restore options and\nthe ",[149,597,599],{"href":598},"\u002Fschema\u002Fprovider-descriptors.json","provider definitions"," for machine-readable\nsupported operations.",[602,603,604],"style",{},"html pre.shiki code .sWZmh, html code.shiki .sWZmh{--shiki-default:var(--mm-code-key)}html pre.shiki code .sIbZ0, html code.shiki .sIbZ0{--shiki-default:var(--mm-code-punctuation)}html pre.shiki code .sv8ni, html code.shiki .sv8ni{--shiki-default:var(--mm-code-string)}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .svrjQ, html code.shiki .svrjQ{--shiki-default:var(--mm-code-function)}html pre.shiki code .sbRf1, html code.shiki .sbRf1{--shiki-default:var(--mm-code-option)}",{"title":177,"searchDepth":195,"depth":195,"links":606},[607,608,609],{"id":157,"depth":195,"text":158},{"id":423,"depth":195,"text":424},{"id":513,"depth":195,"text":514},"Use local Age secrets, an external OpenBao or Vault server, or a managed development server.","md",{},true,{"title":117,"description":610},"docs\u002Fsecret-providers","Wy-_AFkBK5B3uQ5BWpRROgrld2Y-MI6Rnn5h3MFfHAw",1794512546198]