Skip to content
Summer Docs
DocumentationOpen Summer ↗
Documentation /

Summer secrets manager

Store credentials in Summer through the UI or CLI. Doppler is optional.

Summer includes a secrets manager. Store provider credentials directly in Summer through the UI or CLI; you do not need a Doppler account. Doppler is an optional connection for teams that already manage secrets there.

An owner or admin manages credentials in Settings → Integrations. Every credential belongs to the selected company and either production or staging. Provider secrets belong here, away from shared knowledge, support messages and website embed code.

Store a credential in Summer

  1. Confirm the company and Environment.
  2. Open a provider tile and select Add beside a field, or select Add credential below the tiles.
  3. Use the exact variable Name from the provider setup. Names use uppercase letters, digits and underscores and begin with a letter.
  4. Choose Store in Summer as the source.
  5. Enter the secret in Value and select Save credential.

The saved list shows the credential’s name, source, updater and date. It hides the value. Required field counts update after saving; this is not a live check of the provider key.

Use the provider reference to identify required fields. An arbitrary credential name is stored as a credential but does not automatically connect a tool.

For Beluga dashboard access, save BELUGA_DASHBOARD_KEY separately from BELUGA_API_KEY. The dashboard uses its key login form. Investigators use the same Summer credential store for initial login and recovery if the portal loses its session. Hermes' local browser vault is a separate store; an empty local vault does not mean your company credential is missing. Agents receive login status, never the saved key. A saved credential does not guarantee that a provider will accept it or that a dashboard read will succeed.

Store a credential with the CLI

Sign in using the Summer CLI guide, then save a credential from a local environment variable:

sh
summer credentials set STRIPE_READ_KEY --from-env STRIPE_READ_KEY \
  --company COMPANY_ID --environment staging --expected-version 0 --json

--from-env names a local variable that already holds the value. The CLI sends that value directly to Summer's secrets manager. You can also use --from-file PATH or --from-stdin; never pass a secret value as a command argument. The output contains metadata only.

Use --expected-version 0 for a new credential. For an existing or previously removed credential, run summer credentials list --company COMPANY_ID --environment staging --json and use its current version. Replacing an active credential requires the credentials.replace permission. UI and CLI changes use the same company and environment storage.

Set up credentials with MCP

MCP clients can list credential metadata and guide setup using Summer's secrets manager. To save a value, summer_credentials_set with source: local_value returns a local CLI command that uploads it directly to Summer. You can also enter it in Settings → Integrations → Store in Summer. Secret values never go into MCP arguments or chat. Doppler is optional; choose source: doppler only to reference a secret in an already connected Doppler vault. See Connect an MCP client.

Optional: reference an existing Doppler secret

If your team already manages secrets in Doppler:

  1. Under Bring your Doppler vault, select Connect Doppler.
  2. Enter the exact Project and Config for this company and environment.
  3. Enter a Read-only service token for that config. Summer does not accept personal or CLI tokens here. See Doppler’s service-token guide.
  4. Select Verify and save. This checks the vault connection.
  5. Open a credential editor, choose Reference Doppler, and enter the Doppler secret name. This may differ from the Summer credential’s name.
  6. Save the reference. Summer reads its value when needed; secret values continue to be managed in Doppler.

Saving a Doppler reference checks that Summer can read that exact secret from the selected config. It does not test the key against its provider. Verify the provider account and required reads as part of the workflow setup.

To rotate the vault token, open Edit connection, enter a new token and verify it. To switch projects or configs, remove the existing Doppler credential references first. Summer does not edit your Doppler secrets.

Edit or rotate a provider key

Select Edit beside the saved credential. For a Summer-stored credential, enter its Replacement value and save. Leaving that field blank keeps an existing stored value; restoring a removed credential or switching to Summer storage requires a value.

For a Doppler reference, update the secret in Doppler or edit the referenced secret name in Summer. Use the provider’s rotation procedure, verify the replacement with the required workflow, then revoke the obsolete key at the provider. If a key was exposed, follow your incident process and revoke it promptly.

If Summer reports that the record changed, reload the current settings before editing again. Avoid overwriting another administrator’s update.

Reveal, remove and audit

Reveal displays a credential temporarily. It hides after 30 seconds or when page visibility changes. Reveals are recorded in Credential history, alongside saved changes. Use Hide to dismiss it sooner.

Remove stops Summer from using the saved credential. Removing a Doppler reference leaves the original vault secret intact. Disconnect Doppler makes its references unavailable until reconnection.

Removal from Summer does not revoke a key or an existing signed-in session at the provider. Revoke those at the provider when required. Removing a custom integration’s setup also leaves its credentials in the saved list; remove them separately if no longer needed.

If credential storage is unavailable, contact Summer to finish setup. Do not send a key through the help form or email. See Troubleshooting.

UP NEXTProvider setup reference →