> ## Documentation Index
> Fetch the complete documentation index at: https://docs.malak.vc/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets management

We do not store secrets or api keys as-is in the database instead
we use a form of secret management system, we currently support a few
which will be listed before. Our source code is 100% public and you can view
the implementations on [Github](https://github.com/ayinke-llc/malak/tree/main/internal/secret).

We also deploy the exact version on Github to our prod servers without any modification
whatsoever. Our deployment can be found on [github too](https://github.com/ayinke-llc/malak/blob/main/.github/workflows/deploy-production.yml)

<Warning>
  There currently isn't a migration process from one provider to another but it
  is something we might explore in the future. Which is also why we have chosen
  to support only the most reliable and popular managers
</Warning>

### AES

<Tip>
  We highly recommend this as it does not require you to set up another infra
</Tip>

> While this is not a secret manager, `aes-gcm` encrypts your data before being stored in the database.

<CodeGroup>
  ```txt env theme={null}
  MALAK_SECRETS_PROVIDER=aes_gcm
  MALAK_SECRETS_AES_KEY=ujffjkfk
  ```

  ```yml yaml theme={null}
  secrets:
    provider: aes_gcm
    aes:
      key: ujffjkfk
  ```
</CodeGroup>

You can generate you `aes_gcm` key with `LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32; echo`

### Hashicorp Vault

<CodeGroup>
  ```txt env theme={null}
  MALAK_SECRETS_PROVIDER=vault
  MALAK_SECRETS_VAULT_ADDRESS=ujffjkfk
  MALAK_SECRETS_VAULT_TOKEN=ujffjkfk
  MALAK_SECRETS_VAULT_PATH=ujffjkfk
  ```

  ```yml yaml theme={null}
  secrets:
    provider: vault
    vault:
      address: ujffjkfk
      token: ujffjkfk
      path: ujffjkfk
  ```
</CodeGroup>

### Infisical

<CodeGroup>
  ```txt env theme={null}
  MALAK_SECRETS_PROVIDER=infisical
  MALAK_SECRETS_INFISICAL_CLIENT_ID=ujffjkfk
  MALAK_SECRETS_INFISICAL_CLIENT_SECRET=ujffjkfk
  MALAK_SECRETS_INFISICAL_SITE_URL=ujffjkfk
  MALAK_SECRETS_INFISICAL_ENVIRONMENT=ujffjkfk
  ```

  ```yml yaml theme={null}
  secrets:
    provider: infisical
    infisical:
      client_id: ujffjkfk
      client_secret: ujffjkfk
      site_url: ujffjkfk
      environment: prod
  ```
</CodeGroup>

### AWS Secrets Manager

<CodeGroup>
  ```txt env theme={null}
  MALAK_SECRETS_PROVIDER=secrets_manager
  MALAK_SECRETS_SECRETS_MANAGER_REGION=eu-west-2
  MALAK_SECRETS_SECRETS_MANAGER_ACCESS_KEY=jgkjfk
  MALAK_SECRETS_SECRETS_MANAGER_ACCESS_SECRET=jgkjfk
  MALAK_SECRETS_SECRETS_MANAGER_ENDPOINT=eu-west-2
  ```

  ```yml yaml theme={null}
  secrets:
    provider: secrets_manager
    secrets_manager:
      region: ujffjkfk
      access_key: ujffjkfk
      access_secret: ujffjkfk
      endpoint: prod
  ```
</CodeGroup>