Environments and the credential vault
Environment variable sets with secrets substituted into requests as {{VAR}}, and the monitor credential vault — bearer, API key, basic, mTLS, OAuth2, JWT, NTLM, Kerberos, AWS SigV4.
Environment variable sets
An environment under Settings → Environments is a named set of variables — Production, Staging, QA, or any name — that HTTP, API and multi-step monitors can reference. Bind a monitor with config.environment_id, then write {{BASE_URL}} in a target, header or body and {{secret.TOKEN}} for a secret.
| Limit | Value |
|---|---|
| Variables per environment | 50 (name ≤ 100 chars, value ≤ 2000, names match ^[A-Za-z_][A-Za-z0-9_]*$) |
| Secrets per environment | 50; encrypted at rest, only a masked hint is ever returned |
| Reserved prefix | secret. — used for the substitution syntax |
Reading environments needs the developer role or above; creating, editing and deleting is owner/admin. Routes live on the auth service: GET/POST /api/v1/auth/organization/environments, GET/PUT/DELETE …/{id}, POST …/{id}/secrets, DELETE …/{id}/secrets/{secretId}. Environments are available on every plan.
environment on each monitor (development, staging, production; default production) is what an API key's allowed environments restriction is checked against. It is set through the API, not the monitor form.Credential vault
Settings → Monitor credentials stores the authentication material monitors use, so a token lives in one place and a rotation is one edit. A monitor references a credential by id with config.auth_type and config.auth_credential_id (gRPC: grpc_credential_id).
| `type` | Fields |
|---|---|
bearer | token |
api_key | header name, value |
basic | username, password |
mtls | client certificate and key, and/or CA certificate (PEM) |
oauth2 | client id, client secret — client-credentials flow |
jwt | signing key (HS256) |
ntlm | username, password |
kerberos | principal, password |
custom | a raw value for a header you name |
aws_sigv4 | access key id, secret access key, optional session token |
The secret is shown once at creation and never again; the list returns a masked hint, last_rotated_at, an optional rotation_period_days and a rotation_overdue flag, and the platform emails a reminder when a rotation is due. Rotate with PUT /api/v1/auth/organization/monitor-credentials/{id}/rotate. Listing needs developer or above; writes are owner/admin.