> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# External secrets

> Resolve deployment secrets from one environment-configured Infisical or Doppler identity.

Towbar supports Infisical and Doppler as external secret providers. Provider
credentials live only in the control-plane environment. Workload manifests
contain references, and Towbar resolves values during deployment without
placing them in Git or returning them to the dashboard.

## Infisical

```dotenv theme={"system"}
TOWBAR_INFISICAL_ENABLED=true
TOWBAR_INFISICAL_BASE_URL=https://app.infisical.com
TOWBAR_INFISICAL_ALLOW_PRIVATE_NETWORK=false
TOWBAR_INFISICAL_CLIENT_ID=<machine-identity-client-id>
TOWBAR_INFISICAL_CLIENT_SECRET=<machine-identity-client-secret>
```

Use a machine identity restricted to the projects, environments, paths, and
secret versions that Towbar workloads reference. Enable private-network access
only for an intentionally self-hosted Infisical endpoint.

## Doppler

```dotenv theme={"system"}
TOWBAR_DOPPLER_ENABLED=true
TOWBAR_DOPPLER_TOKEN=<service-token>
```

Use a service token scoped to the required project and configuration. Towbar
does not accept a personal dashboard token as a substitute for deliberate
machine access.

## Reference a value

The map key becomes the application environment variable. The reference names
the provider integration, provider-specific secret path or name, optional field
and version, and whether the value is required at build or runtime:

```yaml title=".towbar/apps/api.app.yml" theme={"system"}
externalSecrets:
  STRIPE_SECRET_KEY:
    integration: infisical
    secret: /production/stripe
    field: secret_key
    use: runtime
```

Resources and Compose projects accept runtime references. Dockerfile and static
Apps can also use build references through their secret-safe build path. Other
builders reject build secrets rather than risking them in image layers or
caches.

Validate and restart Towbar after changing a provider. Deploy a non-production
workload that references a test secret before rotating production credentials.
See [Shared and workload secrets](/docs/secrets#external-secret-providers) and
the [deployment manifest](/docs/deployment-manifest).