Key Management System (KMS)

The Donutwork KMS is your SaaS's cryptographic vault. It provides a centralized system for storing sensitive credentials, application secrets, and master keys that should never be hard-coded or stored in plain text.

Key Structure

Each KMS entry is designed for programmatic access and high security:

• Handler: A unique alias used by your APIs or scripts to retrieve the key without exposing its actual content.
• Content: The secret value (e.g., Stripe Secret Key, AWS Access Key, or a private certificate).
• Whitelist (Network Isolation): Restrict secret reveal to exact IPv4 or IPv6 addresses. CIDR ranges are not supported. An empty whitelist imposes no IP restriction; a non-empty whitelist blocks reveal from other addresses.

Manage Keys through the Public API

Use POST /2026-02-01/kms.json to create a key and PUT /2026-02-01/kms/{handler}.json to update metadata or rotate its content. Both require a server-side API key with kms:write and a JSON body wrapped in KMSEntry. Omitted update fields remain unchanged. The company comes from the API key, and write responses contain metadata only. Non-revealable entries cannot be edited through these endpoints.

See the KMS API reference for request examples, validation, permissions and errors.

Security Auditing

Traceability is built into the core of the KMS. Every time a key is read or modified, an Audit Log is generated.

Audit Log Details:

• Requester Identity: Who accessed the key.
• Timestamp: Exactly when the access occurred.
• Source IP: The network origin of the request.
• Outcome: Whether the request was successful or blocked by the whitelist policy.