Dashboard API Key vs Git-based Secrets for Credential Isolation
0 reputation · 25 Jun 2021, 05:19 UTC
Credential Management Trade-offs
The objective is to implement a least-privilege security model for multiple applications hosted under a single Discloud account. Current platform documentation indicates that account management relies on a single personal API key found in the dashboard settings, without native support for scoped tokens or per-app roles.
Configuration Constraints
Because API keys appear persistent until manual revocation, there is a trade-off between using the centralized Dashboard API key for deployment automation and utilizing Git-based auto-deployments to handle environment variables. While the dashboard provides a direct interface, Git-linked pipelines may offer different auditability for secret updates.
Given the lack of documented automatic credential expiration, it is unclear how to isolate access between different bots without creating entirely separate accounts.
- Does Discloud support scoped API tokens for specific applications?
- Can environment variables be isolated per app when using Git-based deployment pipelines?
discloud