Skip to main content

Secrets

Secrets secure integrations and sensitive settings in Seiri.

What is stored securely​

  • Notification channel tokens (Slack, Discord, Teams, …)
  • Kubernetes cluster secrets (sks_…) after registration
  • Account security (passkeys, TOTP, recovery codes) under Settings → Security

Webhook endpoint IDs are capabilities: anyone with the ping URL can check in. Treat them like monitor tokens — do not publish them publicly.

Practices​

  1. Rotate Kubernetes cluster secrets via Rotate secret if leaked.
  2. Rotate channel webhooks/tokens in the provider and update Seiri.
  3. Prefer separate webhooks for staging vs production.

Tip: Heartbeats on ping.seiri.app do not use Bearer tokens — the endpoint ID is the credential.