Loading page
Secret Storage
Secret Storage as a customer-facing product is planned. The foundation already runs: the Stripe and Paddle credentials you connect are verified, written to OpenBao, referenced by path and version, leased for a bounded time and rotated through a retirement ledger. No route returns them, and no log prints them.
Not available yet — Secret Storage is a planned capability. It is not part of Paycux today and cannot be enabled from the console. What Paycux provides today.
This preview is not a currently available API contract.
Status
Foundation
The key must match the connection's mode, then it is checked with a read-only, time-bounded provider call. A rejected key stores nothing and answers 400 PROVIDER_REJECTED.
The value goes to OpenBao under a path scoped to the workspace, project and environment. Paycux keeps only that path and a version number, and a reference from another environment is refused.
A route that needs the key leases it for a bounded time, capped at five minutes, and erases it afterwards. Rotation writes a new version, verifies it, activates it and revokes the old one; the maintenance worker retires what a request could not.
Reference, not value
A provider connection in the console shows its name, provider, mode, status and whether a signing secret is attached. The workspace export is built the same way. The value itself exists in OpenBao and, for the length of one request, in a buffer that is erased when the request ends.
Rotation
A rotation writes the replacement as a new version, verifies it with the provider while the old version is still active, then activates it through a ledger and revokes the previous version. If anything fails before activation, the replacement is discarded and the working credential stays in place.
Foundation
These behaviours exist in the deployed API for the credentials you connect. A general-purpose secret API for your own application is planned and not available.
Provider-connection routes
These routes manage provider credentials and exist in the deployed API. A general secret API is not available yet.
1# Console session: owner or admin2curl -X POST "https://api.paycux.com/v1/environments/<environment id>/provider-connections" \3 --cookie "__Host-paycux_session=<session cookie>" \4 -H "Content-Type: application/json" \5 -d '{6 "projectId": "<project id>",7 "name": "paddle-sandbox",8 "provider": "paddle",9 "mode": "sandbox",10 "apiKey": "<Paddle sandbox API key>",11 "webhookSecret": "<Paddle notification secret>"12 }'1314# 201 Created: the key is verified, stored in OpenBao and never returned15{16 "id": "<connection id>",17 "name": "paddle-sandbox",18 "provider": "paddle",19 "mode": "sandbox",20 "status": "pending_webhook_verification",21 "hasWebhookSecret": true,22 "createdAt": "2026-10-13T09:00:00.000Z",23 "updatedAt": "2026-10-13T09:00:00.000Z",24 "webhookPath": "/v1/provider-connections/<connection id>/webhooks/paddle"25}
Questions
No. The only secrets Paycux stores are the provider credentials of the connections you create: API keys and webhook signing secrets. A customer-facing secret API and console are planned, and this page will say so plainly until they exist.
In OpenBao, under a path scoped to the workspace, project and environment. Paycux persists only that path and a version number. A route that needs the key leases it for a bounded time and erases the buffer afterwards.
The working credential stays in place. A replacement that the provider rejects is discarded before activation. If the request ends after activation but before the old version is retired, the maintenance worker completes the retirement.
No. It is never returned, not in the create response, the list, the console or the workspace export. If you have lost it, rotate the connection with a new key from your provider.
Owners and admins. Other roles can read the connection list. Creating, enabling and rotating are damped per member, so a compromised session cannot use Paycux to test a pile of keys.
Keep exploring
Provider credentials already get the handling described here. A secret API for your own application will be listed on the implemented page when it exists.