Back to Help

Secrets Guide

Secrets is a secure vault for storing credentials, API keys, and certificates.

Security Model

Nocarta uses two-tier encryption:

Tier 1 (Server-Protected)

  • Encrypted at rest on the server
  • Server decrypts and delivers to desktop app during automation
  • Best for: Credentials used in automations (API keys, service accounts, automation logins)

Tier 2 (Client-Protected)

  • Encrypted with your master password
  • Server cannot decrypt - only your device can
  • Requires master password to view or use
  • Best for: Personal sensitive credentials that should never leave your control (banking, admin passwords, personal accounts)

Setting Up Your Vault

First-Time Setup

  1. Navigate to /vault/setup
  2. Create a master password (for Tier 2 secrets)
  3. Save your recovery key - this is the only way to recover if you forget your master password
  4. Your vault is ready

Unlocking

  1. Navigate to /secrets or /vault/unlock
  2. Enter your master password
  3. Vault remains unlocked for your session

Managing Secrets

Creating a Secret

  1. Click Add Secret
  2. Choose the type:
    • API Key: For service integrations
    • Password: Login credentials
    • Keypair: SSH keys, signing keys
    • Certificate: SSL/TLS certificates
    • Database Credentials: Connection strings
    • Generic: Any other sensitive data
  3. Set protection level (Tier 1 or Tier 2)
  4. Enter the secret value
  5. Optionally set expiration date and tags
  6. Save

Viewing a Secret

  1. Navigate to the secret
  2. Click Reveal (requires unlock for Tier 2)
  3. Value is displayed temporarily
  4. Click Copy to copy to clipboard

Version History

  • Every change creates a new version
  • View history: Secret → Versions tab
  • Restore previous version if needed

Using Secrets in Automations

Secrets can be injected into automation steps:

  1. Open an automation
  2. Go to Bound Secrets tab
  3. Click Bind Secret
  4. Select the secret and the placeholder name
  5. In automation steps, use {{placeholder_name}} syntax
  6. At runtime, the desktop app replaces placeholders with actual values

Security Note: Secret injection happens on your desktop, never on the server. This ensures your credentials are handled securely during automation.

Import & Export

Importing Secrets

You can import secrets from other password managers or CSV files.

  1. Go to Secrets
  2. Click Import
  3. Select your source format
  4. Upload your export file
  5. Review and confirm

Supported Import Formats

Format Name Column Password Column Other Fields
1Password title password username, url, notes, tags
LastPass name password username, url, extra, grouping
Bitwarden name login_password login_username, login_uri, notes, folder
Chrome name password username, url
Firefox url password username
Generic CSV name password, value, or secret multiple fallbacks supported

Note: All imported secrets are created as Tier 1 (server-encrypted). You can upgrade individual secrets to Tier 2 after import if needed.

Exporting Secrets

  1. Go to Secrets
  2. Click Export
  3. Authenticate with your master password
  4. Choose format (CSV, JSON, or ZIP with files)
  5. Download your backup

Security: Export files contain sensitive data. Store them securely and delete after use.

Best Practices

  • Use Tier 2 for anything you wouldn't want exposed if the server were compromised
  • Set expiration dates for rotating credentials
  • Use tags to organize (e.g., "production", "staging", "personal")
  • Review access logs periodically

Need More Help?

Ask AI Assistant