Access keys provide programmatic access to vault data through Secryn’s API. They are always scoped to a single vault and are intended for automation, integrations, and non-interactive workflows.

What Is an Access Key?

An access key is a read-only credential for one vault. When paired with that vault's ID, it lets a client read resources from that vault. Access keys:

• are vault-scoped and never cross vault boundaries
• do not inherit a user role, and project RBAC does not narrow them
• cannot modify resources (GET and HEAD only on the vault API)
• can be rotated or revoked at any time

Vault Scope

Each access key belongs to exactly one vault. Project-level permissions and restricted vault rules do not apply—if the key is valid, access is granted only within that vault. This makes access keys suitable for external integrations where fine-grained project permissions are not desired.

What Can Be Accessed

Using an access key, clients can:

• fetch all secrets in a vault (with values)
• fetch only secret names and IDs
• fetch keys and certificates stored in the vault
• fetch individual resources by ID

Responses always reflect the current active state of the resource.

Authentication Model

API calls include:

• the vault ID in the request path
• the access key in the Authorization: Bearer header

Query parameters such as include, resource, and secrets select the response. They do not authenticate the caller, and the access key is not accepted as a query parameter. Missing or invalid credentials return 401. Access keys do not represent users and do not create user sessions.

Security Characteristics

• long random tokens, shown only once at creation or rotation
• stored as an HMAC-SHA256 hash keyed by APP_KEY (a legacy plaintext access_key column is still accepted when a row still has one)
• bypass user roles but remain vault-scoped
• recorded in request logs
• revocation is immediate, unless a grace period is configured (the default grace period is none)

Revoke and replace a key immediately if compromise is suspected.

Lifecycle Management

• create an access key for a vault
• rotate by generating a new key
• revoke without affecting vault contents or public URLs

Rotation does not modify stored resources.

Access Keys vs Public URLs

Use access keys when multiple resources or secrets must be accessed. Use public URLs only when a single key or certificate needs to be shared without authentication.

Best Practices

• use a separate vault when two integrations need separate keys (each vault has one access key)
• rotate keys periodically
• never embed keys in client-side code
• store keys in secure environment variables or secret stores
• revoke unused or compromised keys immediately

Access keys are the primary mechanism for secure, automated access to vault data in Secryn, providing a predictable integration model without exposing user credentials.