Importing external secrets
Import secrets into your services from Vault, AWS, GCP, Azure, Doppler and more.
If your team already keeps its secrets in a secret managerA service built to store passwords and keys, like Vault or AWS Secrets Manager., your services can read them from there. You don't need to copy them into Pyo.
Connect a store
Open Integrations in the sidebar's Team section. Choose Connect under Secret stores and pick your provider. Pyo checks the connection before saving. Team owners and admins can do this from the dashboard, but not with an API key.
| Provider | What you need |
|---|---|
| HashiCorp Vault | The address, the KV v2 mountThe path where Vault's key-value secrets engine, which holds your secrets, is set up. (secret by default) and a token |
| OpenBao | The same as Vault |
| Infisical | The address, a project ID, an environment, and a machine identity's Universal Auth client ID and secret |
| AWS Secrets Manager | The region, and an access key allowed secretsmanager:GetSecretValue |
| GCP Secret Manager | A service accountA Google Cloud identity for programs rather than people.'s JSON key, with the Secret Manager Secret Accessor role |
| Azure Key Vault | The vault URL, and a tenant ID, client ID and client secret for an app allowed to read secrets |
| Doppler | A service token for the config you want |
Give Pyo read-only access to only what it needs. For Vault and OpenBao, the token also needs to read auth/token/lookup-self so Pyo can check it. Pyo doesn't renew tokens. Use a long-lived token, and update it under Edit before it expires.
Any address you enter must use https://. Plain http:// only works on a private network, such as Tailscale. An installation can turn off private networks with PYO_ALLOW_PRIVATE_NETWORKS. Pyo Cloud does this. Pyo's own server and cluster network are never allowed.
For AWS, GCP and Azure, connecting only checks that the login works. Use Check on a service to confirm it can read a secret. Temporary AWS credentials stop working when they expire, so use a long-lived access key.
Import into a service
Open the service's Settings tab, then Environment. Under Imported secrets, choose a store, enter a path and choose Check. Pyo shows the names it found, never the values. Choose Add, then redeploy.
- For Vault and OpenBao, the path is the secret's path, like
app/production. - For Infisical, the path is a folder in the store's environment, like
/backend. - For AWS, GCP and Azure, the path is the secret's name.
- For Doppler, there's no path. A service token reads its whole config.
In AWS, GCP and Azure, a secret holding a JSON object becomes one variable per field. Any other secret becomes one variable named after it, so prod/stripe-key becomes STRIPE_KEY.
A service can import more than one path. If a name appears twice, the service's own variables win. After those, earlier imports win over later ones. Names that aren't valid environment variables are skipped.
When secrets update
Pyo reads your store each time the service deploys. Changing a secret in your store doesn't affect running services. Redeploy to pick up the change.
Once read, values are encrypted with your team's key and stored with that deployment. That means:
- Running services keep working if your store goes down.
- A rollback restores that version's values without needing the store.
- If Pyo can't reach your store during a new deploy, the deploy stops instead of starting without its secrets.
Removing a secret from your store doesn't remove it from past deployments. If a secret leaks, rotateReplace it with a new value, so the leaked one stops working. it in the service it belongs to, then redeploy.