Hefest Lockbox

Overview

Every machine and secret pair without an explicit grant has no access.

Needs attention

Common tasks

Create a new alias or update a value from an exact file import.
Grant or adjust access per machine and alias, with read, write and offline TTL.
Enroll or rotate a machine key, or revoke a machine.
Deliberately reveal a value when you must inspect it.
Change your Lockbox password.

Secrets

Aliases and metadata only. Values never appear here. Machines can update an alias only after an administrator creates it and grants write access.

Machines

Each machine holds a distinct key. Expiry and revocation are enforced on every request.

Enroll or rotate a key

Rotation immediately replaces the machine's previous key. The new key is shown once, here, for private provisioning.

Access grants

Each row is one exact machine and alias pair. Read and write are independent. Offline seconds bound how long a machine may serve a cached value without contacting the service; zero disables caching.

Add or replace a grant

Import or update a value

The file is stored byte for byte, including whitespace and line endings. Version 0 creates a new alias. Updating an existing alias requires its current version, and the same bytes keep the version unchanged.

Secret alias

Letters, digits, slash, underscore, dot and hyphen. Up to 192 characters.

Expected version

Filled automatically when the alias already exists.

Source file

Up to 65536 bytes. The original file is never modified.

Account

Scope

Group

Metadata is set when an alias is created and is not changed by later updates.

Deliberate reveal

Displays one value on this screen after confirmation. The reveal is audited. The value clears automatically after two minutes, when you leave this section, or on sign-out.

Activity

The most recent audit events. Rows record actor, action, alias, result and version only. Loading this list is itself an audited action.

Inventory diagnostics (JSON)

Aliases, machines and grants as returned by the service. Contains no values or keys.

Account

Your Lockbox administrator login. It is independent from the Supabase dashboard account, from machine keys and from the values stored in the lockbox.

Change Lockbox password

The current password is re-verified before the change. Nothing you type here is logged or stored by this page.

Session

Signed in as
Session storage: Tab memory only. Closing or reloading the tab signs you out.
Authorization: Supabase Auth identity checked against the server-side administrator allowlist on every request.