Skip to main content
Use this option when Infisical or Doppler already owns the values. Configure the provider credentials in Towbar first: Infisical setup uses a machine identity, and Doppler setup uses a service token. Credentials stay in Towbar’s protected configuration. The manifest selects which secrets to import without storing their values.

​
Infisical

Set project to the Infisical project ID and, if needed, environmentSlug to the environment’s slug. secretPath selects a folder within that environment.
In an app or resource manifest
Towbar imports every secret directly in the selected folder under its Infisical key name; child folders are not included. environmentSlug and secretPath are optional. If omitted, Towbar uses the prod environment and its root folder. The machine identity needs read access to the chosen project, environment, and folder.
An application's Secrets page showing its Infisical project, environment slug, and secret path without revealing values.
An application's Secrets page showing its Infisical project, environment slug, and secret path without revealing values.

An app’s Runtime Secrets page shows the Infisical source selected by its manifest. Secret values remain with Infisical until deployment.

​
Doppler

Set project to the Doppler project slug. config selects the config whose secrets you want to import.
In an app or resource manifest
Towbar imports every secret in the selected config under its Doppler key name. config is optional when the configured service token is already bound to the intended config. Doppler has no folder path in this manifest form.
A resource's Secrets page showing its Doppler project and config without revealing values.
A resource's Secrets page showing its Doppler project and config without revealing values.

A resource’s Runtime Secrets page shows the Doppler source selected by its manifest. Secret values remain with Doppler until deployment.

​
Deploy with an external source

Sync the manifest, then deploy the workload. External values are resolved at deployment and supplied as runtime variables for apps, resources, and Compose workloads. They are not supplied to builds or deployment hooks; use Towbar-managed secrets for those stages. You can also list required variable names under secrets.runtime. Towbar verifies those names after importing the external values. Deployment stops if a required name is missing, the provider cannot be reached or authorized, the selected scope is empty, or a name collides with a Towbar-managed value. A changed or disappeared external value also stops a deployment in progress. Test access with a non-production workload before relying on it in production.
Last modified on September 26, 2026