Secret templates

The nine typed secret shapes, their fields, and where each one is stored.

How templates work

Every secret has a template. It decides what fields the value has, which of them are sensitive, and where the secret is stored.

Fields marked non-sensitive - a hostname, a port, a region - are copied into metadata alongside the ciphertext so they can be listed and searched without decrypting anything. Sensitive fields exist only inside the encrypted payload.

bash

shortspan secret templates
curl -H "Authorization: Bearer $SHORTSPAN_TOKEN" \
  https://shortspan.dev/api/v1/secret-templates

Both return the live schema, which is the authority if this page ever falls behind.

Two storage behaviours

Storage	Templates	Appears as
Secret	`env`, `plain`, `note`, `json_blob`, `tls_certificate`	A secret under Secrets.
SSH	`ssh_login`	An SSH target under Infrastructure.
Database	`database_url`	A database target under Infrastructure.
AWS	`aws_keys`	An AWS profile under Infrastructure.
Kubeconfig	`kubeconfig`	A Kubernetes context under Infrastructure.

Value templates

env - Environment variable

A single KEY=VALUE pair, injected into a process by shortspan run. Stored as a string.

Field	Input	Sensitive	Required
`value`	textarea	yes	yes

plain - Plain secret

An opaque string: an API key, a token, a password. Stored as a string.

Field	Input	Sensitive	Required
`value`	textarea	yes	yes

note - Secure note

Free-form encrypted text. Recovery steps, a break-glass procedure, anything that should be readable but not public. Stored as a string.

Field	Input	Sensitive	Required
`value`	textarea	yes	yes

json_blob - JSON document

A structured document encrypted as a whole - a service account key file, a webhook configuration. Stored as JSON.

Field	Input	Sensitive	Required
`value`	json	yes	yes

tls_certificate - TLS certificate

A certificate, its private key, and an optional chain. Stored as JSON. The certificate and chain are not marked sensitive - they are public by nature - so they can be inspected without a reveal.

Field	Input	Sensitive	Required
`certificate`	textarea (PEM)	no	yes
`private_key`	textarea (PEM)	yes	yes
`chain`	textarea (PEM)	no	no

Connection templates

A server, keyed by alias. Connect with shortspan ssh <alias>.

Field	Input	Sensitive	Notes
`alias`	text	no	What people type. `prod-web-1`.
`host`	text	no	Hostname or address.
`port`	number	no	Defaults to 22.
`username`	text	no	The account to connect as.
`auth_type`	select	no	`password` or `private_key`.
`credential`	textarea	yes	The password, or the private key in PEM form.

database_url - Database connection

A database, keyed by alias. Connect with shortspan db <alias>.

Field	Input	Sensitive	Notes
`alias`	text	no	What people type.
`driver`	select	no	`postgresql`, `mysql`, or `mongodb`.
`host`	text	no	As reachable from the bastion, if one is configured.
`port`	number	no	Driver default if omitted.
`database`	text	no	The database name.
`username`	text	no	The role to connect as.
`password`	password	yes	Encrypted at rest.

aws_keys - AWS credentials

An access key pair, keyed by alias. Inject with shortspan aws <alias>.

Field	Input	Sensitive	Notes
`alias`	text	no	What people type.
`access_key_id`	text	no	Identifies the key; not itself a secret.
`secret_access_key`	password	yes	Encrypted at rest.
`default_region`	text	no	Injected as `AWS_DEFAULT_REGION`.

kubeconfig - Kubernetes context

A cluster and its kubeconfig, keyed by alias. Enter with shortspan k8s <alias>.

Field	Input	Sensitive	Notes
`alias`	text	no	What people type.
`cluster_name`	text	no	For display.
`kubeconfig`	textarea (YAML)	yes	The whole document is encrypted - it usually contains a client certificate or token.

Creating through the API