Fixed Secret URLs
Stable Team aliases for scripts, agents, and runbooks that need the current encrypted version behind a known name.
Use case
A Fixed Secret URL is a stable Team alias. A script, CI job, or agent can resolve the alias to the current encrypted version without changing every runbook when the underlying secret rotates.
- Stable alias
- Version rotation
- API-key gated
Security boundary
Resolution returns encrypted payload material and lifecycle metadata. It does not return plaintext. The caller still needs the local decryption material or agreed passphrase path.
- Encrypted response
- Scoped API key
- No plaintext response
Scopes
Use the narrowest Team API key scope that matches the automation job.
- fixed:read for resolving
- fixed:write for create/delete
- fixed:rotate for promotion
Example
Use fake values in documentation and store real keys in your secret manager.
curl -X POST https://shhhs.net/api/v1/fixed-urls/github-deploy-key/resolve \
-H 'Authorization: Bearer shhhs_test_api_key_example'