Skip to content
1Claw Academy
← Curriculum
Intermediate

Working with Secrets

Wire secrets into CI, apps, and the SDK, then rotate them safely.

By the end of this track

You’ll be able to wire secrets into CI and applications, scope them per environment, and rotate them without downtime.

10 lessons~29 min30 questions
Start → The CLI in CI/CD
  1. 1The CLI in CI/CDInject vault secrets into any process with env pull, push, and run, using ONECLAW_TOKEN and ONECLAW_VAULT_ID in CI.
  2. 2Lab: leak a secret into a build logLabPublish a token to a log and to the process table in four lines, then fix both without changing what the job does.
  3. 3The TypeScript SDKInstall @1claw/sdk, create a client, and fetch a secret using the {data, error} response envelope.
  4. 4Versioning and RotationRotate secrets server-side or with a client-supplied value, list version history, and disable old versions.
  5. 5Lab: cause an outage by rotating correctlyLabDo every step of a rotation right, in the wrong order, and watch three services stop at once.
  6. 6Lab: predict a token you did not seeLabGenerate secrets the way a lot of code does, then recover one from the clock and predict the next one.
  7. 7Environment variables and bundlesUse first-class per-key env vars with production/preview/development scoping, and know when the older env_bundle secret still fits.
  8. 8Lab: find out why your variable never took effectLabSet a value at the org level, resolve it, and discover which tier quietly overrode you.
  9. 9Agent environment taggingTag an agent as production or preview so its token, its policies, and its env var resolution all agree.
  10. 10Lab: is the SDK you're about to install real?LabQuery the npm registry directly, with no 1Claw endpoint involved at all, and confirm the package this course tells you to install is a live, maintained, versioned artifact rather than a name someone typed into a lesson.