The Keys vault
Per-project credentials behind a code, with time-boxed access and expiry reminders.
The Keys tab is a place to keep the credentials a project actually needs — an API key, a service account, a shared login — next to the work instead of in a chat message somebody can scroll back to. Add it from the + on any project's tab strip. It is a default tab for IT & Managed Services workspaces and available to everyone else on request.
What a key holds
A label, the secret itself, an optional description, and an optional expiry date. The secret is encrypted at rest and never leaves the server unless somebody with access asks to reveal it — the list shows a fixed-width mask that gives away nothing, not even the length.
Getting in
The gate is the whole feature, and it is worked out on the server on every read and every write — never assumed from what the page was handed.
- The person who created the project, and anyone who can edit the organization, are always in — they are also the only people who can set the gate up.
- A code, which everyone else types. Six characters or more; stored one-way, so nobody can read it back — including us.
- A Developer role, if you'd rather gate on who somebody is than on a shared secret. Held by owners and admins out of the box, and meant to be carried by a custom role you define.
Until you are in, the page carries no key list, no count and no hint about how the gate is configured — and every refusal returns the same sentence, so it can't be used to work out which projects hold credentials at all. Rate limiting runs before the project is even looked up, for the same reason.
Unlocking is time-boxed
Typing the code opens the vault for 30 minutes, and the header says when that lapses. Lock now ends it early. The clock is kept on the server, not in your browser, so closing the tab doesn't reset it and a second tab doesn't get a fresh one. Changing or clearing the code ends every live unlock on the project immediately.
Somebody let in with the code can only rotate or delete a credential if they could already edit the project's work. Knowing the code is not the same as being on the team.
Expiry reminders
Give a key an expiry date and Noots warns 14 days, 7 days and 1 day before, and again on the day it lapses. Each rung fires once; editing the expiry date re-arms them, so a renewed credential starts the ladder again.
"The production database password expires in 7 days" is itself a disclosure. Reminders go to the project's leaders, its creator and the key's author — filtered down to the ones who can actually get into the vault. If that leaves nobody, the reminder is recorded as unaddressed rather than sent to somebody who shouldn't have it.
Keys is one of the five tabs that own their own data, so removing it asks whether to take the credentials with it. Answer carefully — that deletes the keys, the code and every live unlock.