Introduction

How does it work

Valt0 stores secrets in encrypted files called vaults.

A vault is simply an encrypted file that has the extension .valt0.

Every vault is identified by an ID and is unlocked by a vault key. The ID is public, while the key is private and must be kept secure.

How are vaults stored

Because a vault is encrypted, it can be stored anywhere.

How many vaults do you need

More than one. The recommended setup is a vault for each environment: dev.valt0, qa.valt0, prod.valt0 and so on.

Valt0 is not limited to a single vault. Every command that works on a vault takes its name, so valt0 store dev:STRIPE_KEY and valt0 store prod:STRIPE_KEY put two different values into two different files. An application can open more than one vault too.

Each vault has its own key, and that is the reason to split them. The whole team can hold the key to dev while the key to prod stays with the people who deploy. If the dev key leaks, nothing in production is exposed, and only the secrets in dev have to be changed.

Store a secret under the same name in every vault. Your code asks for STRIPE_KEY wherever it runs, and only the vault it reads from changes between development, QA and production.

What runs on your machine

Installing Valt0 puts two things on your machine: a command you run, and a service that runs itself.

The service starts when Valt0 is installed, and starts again at every login, so it is already running before anything asks it for a secret. valt0 status says whether it is.