scraps.ggConfiguration

Secrets

Encrypted values scoped to an environment, the services they reach, and the rotation and revocation each one carries.

Application secrets34 exact grants

Delivered versions21 awaiting a retry

Lifecycle policies2Secrets on a rotation schedule

Application secrets

Readable values exist only while they are entered. What is kept is encrypted material and safe version metadata.

TURNSTILE_SECRET_KEY

Production / Application-wide / opaque / 2 exact grants / Ending A810

web, Server runtimeapi, Server runtime

REGISTRY_TOKEN

Production / This environment only / opaque / 1 exact grant / Ending 4C2F

build, Build time

TURNSTILE_SECRET_KEY

Staging / Application-wide / opaque / 1 exact grant / Ending A810

web, Server runtime

Distribution health

Each active version is acknowledged by its consumer on its own, so a failed delivery is retried without cutting a new version.

TURNSTILE_SECRET_KEY Delivered

web / secretversion_scraps_turnstile_3 / 1 attempt / 2 days ago

TURNSTILE_SECRET_KEY Failed

api / secretversion_scraps_turnstile_3 / 2 attempts / 2 days ago

INSTANCE_ACK_TIMEOUT

REGISTRY_TOKEN Delivered

build / secretversion_scraps_registry_1 / 1 attempt / 3 days ago

Lifecycle policy

Rotation, break-glass requirements, and recoverable deletion stay attached to each secret.

TURNSTILE_SECRET_KEY

Rotates every 30 days / Next in 15 days / Recoverable for 7 days / Break-glass

REGISTRY_TOKEN

Rotates every 90 days / Next in 64 days / Recoverable for 7 days / None

A build-time secret is mounted for the build step alone and is left out of the artifact. A runtime secret is delivered by version to the services chosen for it. A value the browser can read is never accepted here.