Creating and Managing Secrets

Overview

Secrets store sensitive information such as credentials, API keys and tokens. This page documents the create form: how to reach it, the fields common to every secret, and the field matrix for each of the seven secret types. Every secret lives in one of three scopes, User, Workspace or Tenant, and each scope has its own route and breadcrumb. The form itself is the same everywhere: a Basic Details card, a Secret Details card that swaps its fields with the chosen type, and a footer holding Reset and Create. Six of the seven types offer a Validate button, and three of them add an optional Metastore dropdown.

Opening the Create Form

1. Open Secrets from the tenant left navigation.
2. Select the scope tab you want the secret to live in, User, Workspace or Tenant.
3. Click + Secret on the toolbar (or the + Secret button in the empty state).

Each scope has its own route and breadcrumb:

Scope	Route	Breadcrumb
User	/tenant/<tenantId>/secrets/create-user-secret	Secrets ❯ User ❯ New user secret
Workspace	/tenant/<tenantId>/secrets/create-workspace-secret	Secrets ❯ Workspace ❯ New workspace secret
Tenant	/tenant/<tenantId>/secrets/create-tenant-secret	Secrets ❯ Tenant ❯ New tenant secret

You can also start from a workspace: the workspace Secrets tab carries the same + Secret button and creates a workspace-scoped secret for that workspace.

Form Layout

The form has two card sections, Basic Details followed by Secret Details, and a footer bar with Reset and Create.

Basic Details

Field	Required	Control	Placeholder / default
Secret Name	Yes	text	title_example_user_secret_1 (same placeholder on all three scopes)
Secret Type	Yes	dropdown	defaults to ENVIRONMENT VARIABLE
Workspace	Yes	dropdown	Workspace scope only — this field is absent on the User and Tenant forms
Description	No	textarea	Enter Description

We mark required fields with a red asterisk. Most fields carry an info icon with a tooltip.

Secret Type Options

The Secret Type dropdown lists all seven types, in this order, at every scope:

1. GOOGLE SERVICE ACCOUNT
2. AZURE SERVICE PRINCIPAL
3. AWS ACCESS SECRET KEY PAIR
4. ENVIRONMENT VARIABLE, default selection
5. DATABRICKS UNITY TOKEN
6. HIVE BASIC
7. HIVE KERBEROS

The overlay is scrollable, so you won't see all seven at once; five are visible at a time.

Secret Details by Type

The Secret Details card changes with the selected type. Don't paste production credentials into documentation or screenshots. The values below are the placeholders we show in the form itself.

1. GOOGLE SERVICE ACCOUNT

Field	Required	Control	Placeholder
Credentials	Yes	large JSON textarea	a full service-account JSON skeleton (below)
HMAC Access key	No	text	Enter HMAC Access Key
HMAC Secret Key	No	text	Enter HMAC Secret Key

The Credentials placeholder is the standard service-account document:

{
  "type": "service_account",
  "project_id": "project-id",
  "private_key_id": "a123b456c789d012e345f678g901h234i567j890",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQ...\n-----END PRIVATE KEY-----\n",
  "client_email": "my-service-account@project-id.iam.gserviceaccount.com",
  "client_id": "123456789012345678901",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/my-service-account%40project-id.iam.gserviceaccount.com"
}

We put an inline note above the HMAC pair:

Provide HMAC keys, as Turbo currently supports only HMAC-based authentication.

A Validate button is available for this type.

2. AZURE SERVICE PRINCIPAL

Field	Required	Control	Placeholder
Client ID	Yes	text	c8b87a2f-41de-4b66-b0d1-9f7cd28fb3c1
Tenant ID	Yes	text	f52d3c1a-9dd8-4a8b-913e-0e27b795ac4a
Client Secret	Yes	password	(none)
Subscription ID	Yes	text	7a94c28e-6c32-4ef2-912f-4fcd528918ef

A Validate button is available, disabled until the fields are filled.

note

This isn't the same field set as Settings ▸ Credentials ▸ Azure Service Principal, which has six fields: these four plus Storage Account Name and Container Name. A secret doesn't carry the storage target.

3. AWS ACCESS SECRET KEY PAIR

Field	Required	Control	Placeholder
AWS Access Key ID	Yes	text	e.g., AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key	Yes	password	e.g., wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
AWS Default Region	Yes	filterable dropdown	Select AWS default region

A Validate button is available, disabled until the fields are filled.

AWS Default Region offers 25 options, in dropdown order:

us-gov-west-1 · us-gov-east-1 · sa-east-1 · me-central-1 · me-south-1 · eu-north-1 · eu-west-3 · eu-south-1 · eu-west-2 · eu-west-1 · eu-central-1 · ca-central-1 · ap-northeast-1 · ap-southeast-2 · ap-southeast-1 · ap-northeast-2 · ap-northeast-3 · ap-south-1 · ap-southeast-3 · ap-east-1 · af-south-1 · us-west-2 · us-west-1 · us-east-1 · us-east-2

4. ENVIRONMENT VARIABLE (default)

Field	Required	Control	Placeholder
Value	Yes	password	Enter Value

It's the only type with no Validate button and no Metastore dropdown.

5. DATABRICKS UNITY TOKEN

Field	Required	Control	Placeholder
Token	Yes	password	e.g., dapi1234567890abcdef1234567890abcdef
Metastore	No	dropdown (right column)	Select Metastore

A Validate button is available.

6. HIVE BASIC

Field	Required	Control	Placeholder
Username	Yes	text	Enter Username
Password	Yes	password	Enter Password
Metastore	No	dropdown	Select Metastore

A Validate button is available.

7. HIVE KERBEROS

Field	Required	Control	Placeholder
Principal	Yes	text	e.g., hive/hostname@REALM.COM
Keytab	Yes	file upload (upload button)	—
Metastore	No	dropdown	Select Metastore

A Validate button is available.

Validate and Metastore

• We show Validate on six of the seven types, every type except ENVIRONMENT VARIABLE, and it stays disabled until the required fields are filled.
• The optional Metastore dropdown appears on exactly the three metastore-oriented types: DATABRICKS UNITY TOKEN, HIVE BASIC and HIVE KERBEROS.

See Secret Validation for the detail.

Saving

• Create saves the secret and returns to the list for that scope.
• Reset clears the form back to its defaults, including the ENVIRONMENT VARIABLE type default.

Managing Existing Secrets

On any secrets list, the Actions kebab menu on a row has exactly two entries:

• Edit : reopen the secret for modification.
• Delete : remove the secret.

Use the Search By Secret Name box on the toolbar to find a secret by name.