Org shared secrets
Updated
Available on Business and Enterprise for managing the catalog and for
creating new project links. In the dashboard this is Org shared secrets
(/shared-secrets), visible to people with catalog permissions.
One organization has one catalog. It is not a hidden project. Labels such as
AWS or Microsoft are filters only. Every new organization, including Free,
starts with development, staging, and production on that catalog. They
stay unused until you link them.
Who can do what
| Who | Catalog | Project org reference |
|---|---|---|
| Owner / Admin | Create, edit, delete, and reveal keys, values, environments, and labels | Create, edit, or unlink immediately |
| Developer | Metadata only (key names, labels, catalog environment slugs). No envelopes | Propose a new link as a change request. Reveal of a linked project key follows that project's environment grant |
| Viewer | No catalog | Cannot create a link |
Reveal on Org shared secrets needs the vault unlocked, same as a project reveal. Reveal of an org reference inside a project uses the project environment grant, not the catalog page.
Author the catalog
The page matches a project: Secrets and Environments.
Add a key the same way you would on a project. Values are encrypted in the browser under the org key and stored per catalog environment. You can add more catalog environments after the three defaults. Deleting a catalog environment is blocked while a project still maps to it.
The calendar on each key sets a rotation reminder (one-time or recurring),
the same control as a project secret. That is the point of the catalog: rotate
AWS_SECRET once and every project org reference picks up the new value.
Due reminders appear on the dashboard Expiring soon card and in the
notification bell. If no recipients are selected, owners and admins are
notified. Reminders stay available after a fallback to Free or Team.
Link from a project
On a project's Secrets tab, Add secret (or edit a key) and set the type to Org reference. Pick one catalog key, then for each project environment choose which catalog environment it should read, or leave it unlinked. Matching slugs are pre-selected.
The project key is a pointer. Kryptic does not copy catalog ciphertext under
the project key, and it does not store a {{org.env.key}} string. Reads
(dashboard reveal, daemon, CI export, REST bundle) resolve the binding at
read time. Decrypt uses the catalog definition id and catalog environment id,
so the blind-store model is unchanged.
A Reference is still a same-project alias. An Org reference points at the organization catalog. A key cannot be both.
Developers who create or change an org reference submit a change request. Approvals shows the catalog key and the environment mappings, not a value to reveal. Owners and admins apply the link immediately.
After a fallback to Free or Team
The catalog stays. Existing org references keep resolving for daemons, CI, and the dashboard. Owners and Admins can still open Org shared secrets to view and reveal.
Blocked until you are on Business or Enterprise again:
- create, edit, or delete catalog keys, values, environments, or labels
- create a new project org reference
Unlinking an existing project org reference stays allowed, so you can turn that key back into a normal String secret.
Self-hosted licences never resolve below Business, so the catalog stays writable there. Cloud orgs that fall back to Free or Team keep their existing links and lose new writes.