Secrets in the Aetherfy dashboard
What the Aetherfy dashboard’s Secrets area is
The Secrets area of the Aetherfy dashboard, at app.aetherfy.com/dashboard/secrets , lists every secret on your account and adds or deletes one. An Aetherfy secret is scoped to one agent or to one workspace, never to the account, which is why this area is its own sidebar entry and not a Settings tab. How secrets are delivered and resolved is explained at Secrets.
A secret’s value is write-only: the list shows its key, scope and last update, and the value always masked. Nothing in Aetherfy reads a value back.
Aetherfy secret labels
| Label | Meaning |
|---|---|
agent | Scoped to one agent, named under the badge. Shown as AGENT |
workspace | Scoped to a workspace and shared by every agent in it, named under the badge. Shown as WORKSPACE |
SCOPE HIERARCHY | The rule beside the list: an agent secret wins over a workspace secret with the same key |
No secrets yet. | The account has no secret |
A change does not reach a machine that already exists: a machine keeps the values
it was created with. A service agent picks a change up on its next deploy — a
Redeploy in the Agents area, afy redeploy, afy deploy
or a push — and a task agent on its next run.
Aetherfy secret actions
| Action | CLI | REST |
|---|---|---|
| INJECT_SECRET — scope, agent or workspace, key, value, and an optional description shown in the list. Saving an existing key replaces its value | afy secrets set (secrets) | POST /api/v1/agents/{agent}/secrets, POST /api/v1/workspaces/{workspace}/secrets (secrets API) |
| List | afy secrets list | GET /api/v1/agents/{agent}/secrets, GET /api/v1/workspaces/{workspace}/secrets |
| Delete — type the key to confirm | afy secrets delete | DELETE /api/v1/agents/{agent}/secrets/{key}, DELETE /api/v1/workspaces/{workspace}/secrets/{key} |
A deleted secret cannot be recovered; anything that reads it fails until it is set again.
What the Aetherfy dashboard does not do for secrets
| Not in the dashboard | Where instead |
|---|---|
| Show a stored value | Nowhere: Aetherfy never returns a secret value |
| Account-wide secrets | They do not exist in Aetherfy. Use a workspace secret for values several agents share |
| Re-encrypt an agent secret’s stored value without changing it | POST /api/v1/agents/{agent}/secrets/{key}/rotate (rotating). To change the value, set it again |
| Apply a change to a running service | Deploy it again — see above |