DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Credentials and secrets store

One encrypted registry behind every credential reference, with versions, rotation, and GitOps envelopes.

ConceptAdministratorSecurity

Key points

  • There is a single credential interface. Models, MCP servers, Git Apps, webhook sources, and registry auth all reference it rather than storing values themselves.
  • NOPSAI_MASTER_KEY is the root encryption material for the registry.
  • Credential values are write-only: the API returns metadata but never the value after submission.
  • Credentials are versioned. A rotation creates a new version, and a specific version can be activated or deleted.
  • A credential can be disabled without being deleted.
  • POST /v1/secrets/encrypt produces a GitOps-safe envelope so a secret can live in a configuration repository without being readable there.

How it works

Legacy inline forms — api_key_secret on an model, auth_secret on an MCP server, GITHUB_PRIVATE_KEY and GITHUB_WEBHOOK_SECRET — remain only for migration. New configuration should use credential references.

Losing the master key makes stored credentials unrecoverable. Rotating it requires re-encrypting the registry, so treat it as the most sensitive value in the deployment.

Examples

Store and rotate a credential without ever reading it backbash
curl -sX POST "$NOPSAI_URL/v1/system/credentials" \
  -H "Authorization: Bearer $NOPSAI_TOKEN" \
  -H "Content-Type: application/json" \
  --data @credential.json | jq -r .id

# rotation adds a version; activation decides which one is in use
curl -sX PUT "$NOPSAI_URL/v1/system/credentials/$CREDENTIAL_ID/value" \
  -H "Authorization: Bearer $NOPSAI_TOKEN" \
  -H "Content-Type: application/json" \
  --data @new-value.json | jq
Result

The registry returns metadata and version history, never a stored value. Rotation is additive, so a bad rotation is recoverable by activating the previous version.

Replace before running
  • credential.json names the credential and its kind; new-value.json carries only the new secret material.

Implementation evidence

  • doc/credential-management.md

    Encrypted registry, GitOps envelopes, AAA, rotation, and migration.

  • services/nopsai/credential_schema.go

    Credential schema and version handling.