Keys and the Vault

Keys never come through the chat: the card, the guard, the Vault, and Deploy now.

The Vault is where a project's keys live: API keys, passwords, tokens, the login to a service. It is the site's settings too: every time FlexOS builds the site, every text key in the Vault goes onto it first. Keys never come through the chat, and two things see to that.

The card

When Flexi needs a key, he puts a card in the chat: for each key its name, a line on what it is, Where to find it when he knows, and a password field. Save sends the value from your browser straight to the Vault. Flexi never sees it; the card then reads Saved to the Vault with the names only, and his next turn is told which names you saved.

• A card works for an hour. After that it says it has expired: ask for a new one, or add the key yourself in Settings › Vault.
• Copy the link on the card opens the same card on another device, with no sign-in, for a key that is on your phone. Saving there fills the card here too.

The guard on the message box

Before a message goes, the page looks for anything shaped like a key, a token, a password, a private key or a card number. If it finds one it does not send, and asks over the box: That looks like a secret key. Put it in the Vault instead?

• Put it in the Vault saves it under a name it guesses (like STRIPE_SECRET_KEY) and puts that name in your message in the value's place.
• Send anyway sends it as typed. It is then visible in the chat; Flexi will say so and offer a card.

Settings › Vault

Every key by name, never by value, in groups. The field at the top finds one or, with Enter, adds a key of that name. Add a key takes a text value, a file (a service-account JSON, a certificate, any secret file), or Paste many: the lines of a .env, one key each. A note on each says what it is for and where it came from.

A key marked public (a publishable key, a project URL or id) is the one kind Flexi may read; every other key he names, never reads.

Keys from an imported zip's .env are here under the names they had. Its GITHUB_TOKEN, VERCEL_TOKEN and VERCEL_TEAM_ID are kept as PROJECT_GITHUB_TOKEN, PROJECT_VERCEL_TOKEN and PROJECT_VERCEL_TEAM_ID, so FlexOS keeps making the repo and the builds with its own.

The login to a service (LOGIN_<SERVICE>_EMAIL and _PASSWORD) and the phone app's signing keys belong to the project's owner alone: only the owner takes them out, replaces or removes them; a team member sees them listed with no part of their values. They are never put on the site or asked for on a card.

Keys on the site

1. Deploy now, in Settings › Deployment, puts the Vault's text keys onto the site and builds it. Files, the phone app's signing keys and the service logins stay off.
2. A build started by a commit, Flexi's included, gets the keys as they were last put on the site. So after you add or change a key, Deploy now is what brings it in.
3. A key you remove stays on the site until it is taken off in Vercel.

Never paste a key in a chat, a document or a page. The guard catches most shapes, not all of them.

Where next

• Connections: each service the project uses, and which of its keys are in.
• Deployment: the address, your own domain, Deploy now.
• Code: what an imported zip brings, and where it goes.

Start free · Rebuild your website · Docs · FAQ