Your API keys,
finally explained.

Know what every credential does, who owns it, and why it exists.

Get startedRead the docs →

An API key shouldn't be an anonymous string.

It signs your billing webhooks. Or it was for an experiment that ended in March. The string can't tell you which — and neither can the person who created it, because they left.

whsec_••••••••••••••••••••••••
STRIPE_WEBHOOK_SECRET · .env.production · line 14
Secrets / Growth
stripe-webhook-prod-billing
Checkout webhook — signs events for the billing service. Verified on every request from Stripe; if this key breaks, invoices stop.
whsec_••••••••••••••••••••RevealCopy
Owner
AVAva
Vendor
Stripe
Team
Growth
Environment
Production
Status
Active
Last rotated
14 days ago by Jordan

Find the one you actually need.

Search by name, vendor, purpose, or owner. Filter by team, environment, and owner. Two Stripe webhooks stop looking identical. The interface below is live — type in it.

Secrets47 active
ActiveArchivedAll
12 keys · sorted by name
stripe-webhook-prod-billingCheckout webhook — signs events for the billing serviceAVAvaStripeGrowthProduction
stripe-webhook-prod-experimentsExperiment endpoint — remove after Q3CACaseyStripeGrowthProduction
github-app-ci-deployDeploy workflow — pushes release images from CIJOJordanGitHubDevOpsProduction
openai-prod-assistantSupport assistant — answers billing questions in-appPRPriyaOpenAIProductProduction
twilio-staging-otpSMS one-time codes for staging sign-inMAMarcusTwilioProductStaging
datadog-agent-prodHost metrics from the Kubernetes agentJOJordanDatadogDevOpsProduction
sendgrid-staging-transactionalPassword reset and receipt emails on stagingCACaseySendGridGrowthStaging
aws-s3-uploads-prodSigned uploads for customer attachmentsAVAvaAWSInfraProduction
slack-bot-alertsPosts deploy and incident alerts to #opsJOJordanSlackDevOpsProduction
vercel-deploy-token-previewPreview deployments for the marketing sitePRPriyaVercelProductStaging
postmark-prod-receiptsOrder receipts and invoice emailsAVAvaPostmarkGrowthProduction
openai-staging-evalNightly eval runs against the assistant promptPRPriyaOpenAIProductStaging
Secrets / Growth
stripe-webhook-prod-experiments
Experiment endpoint for the pricing test — remove after Q3. Do not point checkout at this.
Expires 30 Sep
Owner
CACasey
Team
GGrowth
Vendor
Stripe
Environment
Production
Created
12 Jun 2026 by Casey
Last rotated
Never
whsec_••••••••••••••••••••••••RevealCopyRotate

Know exactly why it exists.

Purpose and owner are required to save a key. Six months later, a third engineer can tell this webhook from the one next to it — and knows it was meant to be deleted.

People leave. Ownership shouldn't disappear with them.

Ava is leaving Acme. Every credential she owns is listed in one place with its purpose, team, and environment — so the handoff is a review, not an archaeology dig. Walk through it.

  1. Offboard a member
Who is leaving?Members · Acme

Credentials change. The record shouldn't.

Rotate a value and the name, purpose, owner and team stay put — the old value is discarded, not archived. Every reveal, copy, rotation and transfer becomes an event with a person and a time.

RotateLast rotated 14 days ago by Jordan
github-app-ci-deploy
Deploy workflow — pushes release images from CI
JOJordan·DevOps·Production

The current value is discarded on rotation. Fally keeps no history of old values. Metadata is untouched.

Logged to Activity
ActivityWorkspace · last 24h
MAMarcus revealed twilio-staging-otp14 min ago
PRPriya copied openai-prod-assistant1 h ago
JOJordan rotated datadog-agent-prod3 h ago
CACasey created sendgrid-staging-transactional in Growth5 h ago
AVAva archived stripe-webhook-staging-legacyyesterday
MAMarcus reveal rate-limited on twilio-staging-otp · 6 in 10 minyesterday
SECURITY

Stated plainly.

Encryption is the floor, not the pitch. Here is what happens to a value once you paste it — and what never happens to it.

1→ TLSClientBrowser · CLI · MCPwhsec_3f9…c2a1plaintext exists here only
2→ encryptAPIAuthorise · rate-limit · logactor · action · timeevery reveal becomes an event
3→ writeEnvelopeEncrypted before writeAES-256-GCM · per-secret keykey material never stored beside the value
4DatabaseCiphertext + metadata0x8a41…e07fname, purpose, owner in the clear — value never
Rotate — overwrite; previous ciphertext discardedReveal / copy — decrypt on request, rate-limited, loggedMCP — metadata only, until an admin enables values
At rest
Values are encrypted before they are written. The database never holds plaintext.
In transit
TLS between the browser, CLI, MCP server, and the API.
Reveal and copy
Deliberate actions, never shown by default. Rate-limited per person; each one is an audit event.
Audit
Reveal, copy, rotate, transfer, archive and offboard are recorded with actor and time.
MCP
Agents get metadata by default. Revealing values over MCP is off until a workspace admin turns it on.

Meet engineers where they work.

The same names, purposes and owners in the terminal and in your agent's context — without the value, unless an admin says otherwise.

ava@acme — zsh
$ fally secrets list --env production --vendor stripe
stripe-webhook-prod-billing Ava Growth active stripe-webhook-prod-experiments Casey Growth expires 30 Sep
$ fally secrets get stripe-webhook-prod-billing
purpose Checkout webhook — signs events for the billing service owner Ava · vendor Stripe · team Growth · env production rotated 14 days ago by Jordan
$ fally secrets reveal stripe-webhook-prod-billing
whsec_•••••••••••••••••••• copied · reveal logged to Activity
$
MCP · get_secret_metadatatool result
{"name": "stripe-webhook-prod-billing","purpose": "Checkout webhook — signs events…","owner": "[email protected]","team": "growth","environment": "production","status": "active","value": null // reveal disabled by admin}

An agent can tell you which key the billing service depends on, and who to ask about it, without ever holding the secret.

Every credential, understood.

What it does. Why it exists. Who owns it. Where it belongs. What happens when things change.

Get startedRead the docs →