Secrets Manager Quick Start

Bitwarden Secrets Manager enables developers, DevOps, and cybersecurity teams to centrally store, manage, and deploy secrets at scale.

The Secrets Manager web app will be your home for setting up your secrets management infrastructure. You'll use it to add and organize secrets, create systems of permissions to fit your needs, and generate access tokens for use by your applications. Once complete, you'll move on to the Developer Quick Start guide to learn how to inject secrets into your machines and applications.

Secrets Manager can be activated from your organization's Billing → Subscription page. You must be an organization owner to do this:

Once activated, Secrets Manager will be available through the web (https://vault.bitwarden.com) using the new product switcher:

Before your take your first steps with Secrets Manager though, you'll need to explicitly invite a few organization members to join.

To give members access to Secrets Manager you must be an organization owner or admin:

1. Open your organization's Members tab and open your Member role panel using the () options menu.

2. At the bottom of the panel, check the This user can access the Secrets Manager Beta box:

   

Repeat those steps for any other organization members whom you want to give access to Secrets Manager.

Use the product switcher to open the Secrets Manager web app. If this is your first time opening the app you'll have an empty vault, but eventually it'll be full of your projects and secrets:

Let's start filling your vault.

Projects are collections of secrets logically grouped together for management access by your DevOps, cybersecurity, or other internal teams. It's important to take into account, when creating your projects, that projects will be the primary structures through which you assign members access to secrets. To create a project:

1. Use the New dropdown to select Project:

   

2. Enter a Project name.

3. Select the Save button.

Adding organization members to your project will allow those users to interact with the project's secrets. To add people to your project:

1. In the new project, select the People tab.

2. From the People dropdown, type or select the member(s) or group(s) to add to the project. Once you've selected the right people, use the Add button:

   

3. Once members or groups are added to the project, set a level of Permissions for those members or groups. Members and groups can have one of the following levels of permission:

   • Can read: Members/groups will be able to view [and edit] existing secrets in this project.

   • Can read, write: Members/groups will be able to view existing secrets and create new secrets in this project.

Now that you have a project with a handful of members who can help you manage it, let's add some secrets to the project. Secrets are sensitive key-value pairs stored in your vault, typically things that should never be exposed in plain code or transmitted over unencrypted channels, for example:

• API Keys

• Application Configurations

• Database Connection Strings

• Environment Variables

You can import secrets directly to your vault as a .json file or add secrets manually:

Now that you've got a project full of secrets, it's time to start constructing machine access to those secrets. Service accounts represent non-human machine users, or groups of machine users, that require programmatic access to some of the secrets stored in your vault. Service accounts are used to:

• Appropriately scope the selection of secrets a machine user has access to.

• Issue access tokens to facilitate programmatic access to, and the ability to decrypt, secrets.

To add a service account for this project:

1. Use the New dropdown to select Service account:

   

2. Enter a Service account name and, in the Access section, type or select the name of the project(s) and/or individual secret(s) that this service account should be able to access.

Access tokens facilitate programmatic access to, and the ability to decrypt, secrets stored in your vault. Access tokens are issued to a particular service account, and will give any machine that they're applied to the ability to access only the secrets associated with that service account. To create an access token:

1. Select Service accounts from the navigation.

2. Select the service account to create an access token for, and open the Access tokens tab:

   

3. Select the Create access token button.

4. On the Create Access Token panel, provide:

   • A Name for the token.

   • A level of Permissions for the token. During the beta, only Can read access is available.

   • When the token Expires. By default, Never.

5. Select the Create access token button when you're finished configuring the token.

6. A window will appear printing your access token to the screen. Copy your token to somewhere safe before closing this window, as your token cannot be retrieved later:

   

This access token is the authentication vehicle through which you'll be able to script secret injection to your machines and applications.

Now that you've got the hang of creating the infrastructure for securely managing secrets, and of creating pathways for machine access to secrets, let's continue on to the Developer Quick Start guide.