ZeroVault Overview

ZeroVault stores secrets for your applications and serves them to any process, CI job, or platform at deploy and runtime. You read and write them from the dashboard, the API, or the zero CLI.

Object model

Organization
└── Project
    └── Environment   (development and production by default)
        └── Secret    (key / value)

• Your organization is your workspace. It is created for you when you sign up, and it owns everything below. You do not create one by hand.
• A project groups the secrets for one app or service. Creating a project automatically gives it two environments, development and production. You can add or delete more.
• An environment holds a flat set of key/value secrets.
• Access is organization-wide. An API key, a zero login sign-in, and a GitHub Actions OIDC token each reach every project and environment in one organization. All three also work for ZeroErrors.

Where things live

• Dashboard: dash.zeroapps.dev/vault: projects, environments, and secrets.
• API keys: dash.zeroapps.dev/keys, outside either product, since one key authorizes both. See API keys.
• Public API: https://api.zeroapps.dev/vault/v1. It takes a bearer token: a zv_… key, a token from zero login, or a token from an OIDC exchange.
• CLI: zero vault …, published as @zeroapps/cli on npm.

Next

• Getting started: the dashboard walkthrough.
• Vault commands: script your secrets with zero vault.
• Loading secrets: pull secrets into any process or CI job.
• Cloudflare Workers: pull secrets into a Worker deploy.