Script Secrets

Script Secrets are encrypted key/value pairs your scripts can use without pasting the raw value into a script body. Devpilot encrypts every secret at rest, masks it in the UI after creation, and substitutes the real value into the command only at execution time.

Typical uses:

• API keys (Slack, PagerDuty, Stripe, cloud providers)
• Database passwords
• Short-lived tokens fetched from a vault
• Auth headers for internal services

What You Configure

Every secret has a key — the reference name your scripts use, like DB_PASSWORD or SLACK_WEBHOOK_URL — plus a value (the real secret) and an optional description so teammates know what it's for. Keys must start with a capital letter and use only capital letters, numbers, and underscores; lowercase letters, dashes, or leading digits are rejected so your keys stay easy to reference in scripts. Descriptions are capped at 500 characters.

The value is encrypted the moment you save and Devpilot never displays the plain text back. The UI shows ***masked*** whenever the secret is listed, and the value can always be overwritten with a new one but never read back.

Scopes

When a script runs, Devpilot looks up secrets in both scopes at once. The secrets manager shows them in two labelled groups — Server Secrets and Workspace Secrets — so you can see at a glance which scope a key lives in.

Creating a Secret

Referencing a Secret in a Script

Use the placeholder {{secret.KEY}} anywhere in your script body. At execution time, Devpilot scans the command for these placeholders, decrypts the matching secrets, and substitutes the real values just before the script is handed off to run.

#!/bin/bash
set -euo pipefail

curl -X POST https://hooks.slack.com/services/xxx \
  -H 'Content-Type: application/json' \
  -d '{"text":"Deploy completed"}' \
  -H "Authorization: Bearer {{secret.SLACK_TOKEN}}"

mysqldump -u app -p"{{secret.DB_PASSWORD}}" app_production > /tmp/db.sql

Quoting Tips

• Wrap placeholders in double quotes when the value may contain spaces or special characters: "{{secret.API_KEY}}".
• For passwords passed to CLIs like mysql, use the tool's password flag without a space (-p"{{secret.DB_PASSWORD}}"), or use a defaults file so the value never appears in process lists.
• For JSON bodies, build the payload with jq or a templating step and inject the secret from an environment variable set inside the script.

Updating and Rotating

Open a secret and type a new value — the next run of any script that references it picks up the fresh value automatically, no script edits needed.

To rotate a key name (for example, renaming SLACK_TOKEN to SLACK_WEBHOOK_URL):

1. Create the new secret with the new key.
2. Update any scripts that reference the old key to use the new one.
3. Delete the old secret once nothing references it.

Deleting a Secret

Deleting a secret removes the encrypted value permanently. Scripts that still reference the deleted key will fail at runtime because the placeholder has nothing to substitute with — it stays in the command as literal text like {{secret.MISSING_KEY}}. Audit your scripts before deleting shared secrets.

Viewing Secrets

The Secrets list shows every key the caller can see, grouped by scope, with every value displayed as ***masked*** so no one can screen-share their way into a leak. Use the copy button next to each key to drop the {{secret.KEY}} placeholder straight into your editor.

Limits and Constraints

• Key format — Keys must start with a capital letter and use only capital letters, numbers, and underscores.
• Key maximum length — 255 characters.
• Description maximum length — 500 characters.
• Scope — A secret is either tied to a single server or applies workspace-wide. There's no per-group scope today.
• Values aren't readable after creation — Save them somewhere else if you need the plain text elsewhere.

Troubleshooting

Next Steps