Secrets

Store credentials and inject them with {$VAR} placeholders.

Secrets are named key-value pairs stored in a proxy's encrypted SQLite database. They are the mechanism by which CIFP injects real credentials without exposing them to clients.

Secret Naming

Secret names follow environment variable convention:

Uppercase letters, digits, and underscores only
Must start with a letter: OPENAI_API_KEY ✓, 3_INVALID ✗
Maximum 255 characters
Names are unique per proxy

Placeholder Syntax

In auto-auth mode, wrap the secret name in {$ and } — opening curly brace first, then a dollar sign, then the name:

bash

Authorization: Bearer {$OPENAI_API_KEY}
X-Api-Key: {$STRIPE_SECRET_KEY}
X-Custom: prefix-{$MY_TOKEN}-suffix

Rules for the secret name inside a placeholder:

Uppercase letters (A–Z), digits (0–9), and underscores only
Must start with a letter or underscore — not a digit
Examples: OPENAI_API_KEY ✓, MY_TOKEN ✓, 3_INVALID ✗

CIFP scans all outgoing request headers for placeholders before forwarding. Multiple placeholders in a single header value are all resolved. Placeholders also work inside the request URL itself. If a named secret does not exist, the placeholder is passed through as-is and the upstream request will likely fail with a 401.

Auto-auth mode only

Placeholder substitution is a feature of auto-auth mode. In firewall mode, CIFP injects credentials via the credential store directly (no placeholder needed in the client request).

Creating Secrets

bash

curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/secrets \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "OPENAI_API_KEY",
    "value": "sk-proj-your-real-key",
    "description": "OpenAI production key (rotated monthly)",
    "expiresAt": "2026-12-31T00:00:00Z"
  }'

The response confirms creation but never echoes the value back. Updating a secret's value is done by posting the same name again — the value is replaced atomically.

Listing Secrets

bash

curl https://cifp.vril.dev/api/proxies/proxy-id/secrets \
  -H "Authorization: Bearer cifp_your_api_key"

# Response: names, descriptions, expiry dates — no values
# {
#   "secrets": [
#     { "id": "secret_xxx", "name": "OPENAI_API_KEY", "expiresAt": null, ... }
#   ]
# }

Deleting Secrets

bash

curl -X DELETE https://cifp.vril.dev/api/proxies/proxy-id/secrets/secret-id \
  -H "Authorization: Bearer cifp_your_api_key"

Deleting a secret removes it from both the database and the proxy's runtime store. Any subsequent request using $THAT_SECRET will pass through the placeholder unresolved (the upstream will likely return 401).

Secret Rotation

To rotate a secret (e.g. after a key refresh), POST the same name with the new value. CIFP updates the proxy's encrypted store atomically — no proxy restart needed. In-flight requests that have already been proxied are unaffected.

bash

# Rotate OPENAI_API_KEY to a new value
curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/secrets \
  -H "Authorization: Bearer cifp_your_api_key" \
  -d '{"name":"OPENAI_API_KEY","value":"sk-proj-new-rotated-key"}'

Secret Expiry

Set expiresAt to an ISO-8601 timestamp to create a time-bounded secret. After the expiry time, the proxy treats the secret as if it doesn't exist. CIFP doesnot auto-delete expired secrets; they remain visible in the listing with their expiry date.