Secrets

Credentials Streamtime holds for you (cloud account keys, kubeconfigs, SSH keys, DNS and monitoring credentials, Kafka passwords) live in a secret store, never in plain configuration.

Store What it is
Built-in vault (default) An encrypted store inside Streamtime. Nothing to set up
HashiCorp Vault (AppRole sign-in) Your own Vault server keeps the secrets and Streamtime’s encryption keys, with automatic key rotation

The store is chosen in first-time setup, at the Secrets Vault step. Settings → Secrets Management then lists the secrets Streamtime holds, and lets you add your own and choose which store each one goes to.

Before you start: HashiCorp Vault

From your Vault administrator:

  • The Vault URL. The Streamtime server must be able to reach it.
  • The Namespace, if you use Vault Enterprise namespaces.
  • An AppRole Role ID and Secret ID for Streamtime. Treat both as credentials.
  • Where AppRole sign-in is mounted (Auth Mount Path) and where the secrets go (Secrets Mount Path, a KV version 2 engine), if not at Vault’s usual paths.

Use HashiCorp Vault

  1. In first-time setup, at the Secrets Vault step, choose HashiCorp Vault (AppRole sign-in).
  2. Enter Vault URL, Namespace (optional), Role ID and Secret ID. Change Auth Mount Path and Secrets Mount Path only if your administrator mounted them elsewhere.
  3. Select Test Connection, then continue.

The store is set during first-time setup only; there is no published API for it yet.

Not available in the CLI.

Not available in MCP.

The API examples below share this setup:

export STREAMTIME_TOKEN=<your-access-token>
export API=https://api.example.com/organizations/<org>

import os
from streamtime_sdk.client import AuthenticatedClient

client = AuthenticatedClient(
    base_url="https://api.example.com",
    token=os.environ["STREAMTIME_TOKEN"],
)
ORG = "<org>"

Uses the generated client in streamtime-sdk/typescript/client.

import { client } from "./client/client.gen";

client.setConfig({
  baseUrl: "https://api.example.com",
  headers: { Authorization: `Bearer ${process.env.STREAMTIME_TOKEN}` },
});
const org = "<org>";

package main

import (
    "bytes"
    "crypto/rand"
    "encoding/hex"
    "encoding/json"
    "net/http"
    "os"
)

const api = "https://api.example.com/organizations/<org>"

// newKey returns a random idempotency key.
func newKey() string {
    b := make([]byte, 16)
    rand.Read(b)
    return hex.EncodeToString(b)
}

// call sends one request with the access token and a JSON body (or none).
// An optional idempotency key is sent as the Idempotency-Key header.
func call(method, path string, body any, idempotencyKey ...string) (*http.Response, error) {
    var buf bytes.Buffer
    if body != nil {
        if err := json.NewEncoder(&buf).Encode(body); err != nil {
            return nil, err
        }
    }
    req, err := http.NewRequest(method, api+path, &buf)
    if err != nil {
        return nil, err
    }
    req.Header.Set("Authorization", "Bearer "+os.Getenv("STREAMTIME_TOKEN"))
    req.Header.Set("Content-Type", "application/json")
    if len(idempotencyKey) > 0 {
        req.Header.Set("Idempotency-Key", idempotencyKey[0])
    }
    return http.DefaultClient.Do(req)
}

Add a secret

Store a value under a path, for example for a workload setting that refers to a secret.

  1. Go to Settings → Secrets Management and select Create Secret.
  2. Choose the Provider (where to store it; it can’t be changed later), enter a unique Path such as apps/db-password, and the Content as plain text or JSON.
  3. Save. The value is never shown again.
curl -X POST "$API/secrets/" \
  -H "Authorization: Bearer $STREAMTIME_TOKEN" -H "Content-Type: application/json" \
  -d '{"path": "apps/db-password", "content": "<value>", "provider": "builtin"}'

provider is builtin or vault. List secrets with GET $API/secrets/ (values are not returned), and the stores available with GET $API/secrets/providers/.

from streamtime_sdk.api.secrets import organizations_secrets_create
from streamtime_sdk.models import Secret

organizations_secrets_create.sync(
    ORG,
    client=client,
    body=Secret.from_dict({"path": "apps/db-password", "content": "<value>"}),
)

import { organizationsSecretsCreate } from "./client";

await organizationsSecretsCreate({
  path: { org_identifier: org },
  body: { path: "apps/db-password", content: "<value>" },
});

resp, err := call("POST", "/secrets/", map[string]any{
    "path":    "apps/db-password",
    "content": "<value>",
})
if err != nil {
    return err
}
defer resp.Body.Close()

streamtime secret create --path apps/db-password --from-file ./db-password.txt
streamtime secret list

Not available in MCP.

variable "db_password" {
  type      = string
  sensitive = true
}

resource "streamtime_secret" "db_password" {
  path    = "apps/db-password"
  content = var.db_password
}

terraform import streamtime_secret.db_password <secret-id>

See streamtime_secret.