Access keys provide programmatic access to vault data through Secryn’s API. They are always scoped to a single vault and are intended for automation, integrations, and non-interactive workflows.

What Is an Access Key?

An access key is a secure, read-only token used to authenticate API requests. When paired with a vault ID, it allows authorized systems to retrieve resources from that vault. Access keys:

• are vault-scoped and never cross vault boundaries
• cannot modify resources
• can be rotated or revoked at any time

Vault Scope

Each access key belongs to exactly one vault. Project-level permissions and restricted vault rules do not apply—if the key is valid, access is granted only within that vault. This makes access keys suitable for external integrations where fine-grained project permissions are not desired.

What Can Be Accessed

Using an access key, clients can:

• fetch all secrets in a vault (with values)
• fetch only secret names and IDs
• fetch keys and certificates stored in the vault
• fetch individual resources by ID

Responses always reflect the current active state of the resource.

Authentication Model

API calls include:

• the vault ID in the request path
• the access key in a header or query parameter

Missing or invalid values cause the request to fail. Access keys do not represent users and do not create user sessions.

Security Characteristics

• long, unguessable tokens
• shown only once at creation time
• bypass user roles but remain vault-scoped
• fully logged in request logs
• revocation is immediate

Revoke and replace a key immediately if compromise is suspected.

Lifecycle Management

• create an access key for a vault
• rotate by generating a new key
• revoke without affecting vault contents or public URLs

Rotation does not modify stored resources.

Access Keys vs Public URLs

Use access keys when multiple resources or secrets must be accessed. Use public URLs only when a single key or certificate needs to be shared without authentication.

Best Practices

• create a separate access key per integration
• rotate keys periodically
• never embed keys in client-side code
• store keys in secure environment variables or secret stores
• revoke unused or compromised keys immediately

Access keys are the primary mechanism for secure, automated access to vault data in Secryn, providing a predictable integration model without exposing user credentials.