Laravel, CI/CD and API Integrations

SecretStash works anywhere you can run a command: a Laravel app through the Composer package, a Node project through the npm package, and GitHub Actions or GitLab CI by running the same CLI in your pipeline. Every integration pulls encrypted values and decrypts them on the machine that runs the command, then writes a normal .env file your app already reads.

How do you add SecretStash to a Laravel app?

Install the Composer package, log in once, and pull. The whole setup is three commands and one environment variable, and nothing in your application code changes because Laravel keeps reading the same .env file.

1. Install the package: composer require dniccum/secret-stash-cli
2. Connect the CLI to your account: php artisan secret-stash:login. This opens your browser, and once you approve, it saves an API token to SECRET_STASH_API_TOKEN in your .env.
3. Set SECRET_STASH_APPLICATION_ID in your .env to the ID shown for your application in the dashboard.
4. Create this device's encryption key: php artisan secret-stash:install. The private key is written to ~/.secret-stash/device_private_key.pem and never leaves your machine.

From there, push the .env file you already have with php artisan secret-stash:variables push --environment=local --file=.env, and teammates pull it with php artisan secret-stash:variables pull --environment=local.

Which variables does SecretStash skip?

Anything starting with SECRET_STASH_ is never pushed, so your own API token and application ID stay on your machine. To keep other machine-specific values out, such as a local DB_DATABASE, list them under ignored_variables in config/secret-stash.php. Ignored keys are case-sensitive.

How does a new teammate get access?

They install the package, run php artisan secret-stash:login, and run php artisan secret-stash:keys init once to create their own device key. Someone who already has access then runs php artisan secret-stash:share --environment=production, once per environment, which encrypts that environment's key for the new device. The teammate can pull as soon as that finishes. No value is pasted into Slack or email along the way.

Does SecretStash work with Node projects?

Yes. The secret-stash-node package on npm gives Node projects the same pull and push workflow against the same applications and environments. A team with a Laravel API and a Node front end can keep both sets of variables in one SecretStash organization.

How do you pull secrets in GitHub Actions?

Run the CLI as a step before your build or deploy. There is no separate GitHub Action to install: the job installs your Composer dependencies, restores a device key from repository secrets, and runs the same pull command you use locally.

The CLI reads three values from the environment, so nothing has to be committed:

• SECRET_STASH_API_TOKEN: an API token, stored as a repository secret.
• SECRET_STASH_APPLICATION_ID: your application's ID.
• SECRET_STASH_KEY_DIR: the directory holding the device key files (device_private_key.pem and device.json). In CI, write both files from secrets into a temporary directory and point this variable at it.

A deploy job then looks like this:

- name: Pull production variables
  env:
    SECRET_STASH_API_TOKEN: ${{ secrets.SECRET_STASH_API_TOKEN }}
    SECRET_STASH_APPLICATION_ID: ${{ secrets.SECRET_STASH_APPLICATION_ID }}
    SECRET_STASH_KEY_DIR: ${{ runner.temp }}/secret-stash
    DEVICE_KEY: ${{ secrets.SECRET_STASH_DEVICE_KEY }}
    DEVICE_JSON: ${{ secrets.SECRET_STASH_DEVICE_JSON }}
  run: |
    mkdir -p "$SECRET_STASH_KEY_DIR"
    printf '%s\n' "$DEVICE_KEY" > "$SECRET_STASH_KEY_DIR/device_private_key.pem"
    printf '%s' "$DEVICE_JSON" > "$SECRET_STASH_KEY_DIR/device.json"
    php artisan secret-stash:variables pull --environment=production --file=.env

GitHub masks secret values in logs. See GitHub's guide to using secrets in GitHub Actions for how repository and environment secrets are scoped.

How do you pull secrets in GitLab CI?

The same way: set the three variables and run the pull command in a job before deploy. In GitLab, store the private key as a CI/CD variable of type File, and GitLab writes it to a temporary path for you.

deploy:
  stage: deploy
  script:
    - export SECRET_STASH_KEY_DIR="$CI_PROJECT_DIR/.secret-stash"
    - mkdir -p "$SECRET_STASH_KEY_DIR"
    - cp "$SECRET_STASH_DEVICE_KEY" "$SECRET_STASH_KEY_DIR/device_private_key.pem"
    - cp "$SECRET_STASH_DEVICE_JSON" "$SECRET_STASH_KEY_DIR/device.json"
    - php artisan secret-stash:variables pull --environment=production --file=.env

Mark SECRET_STASH_API_TOKEN as masked and protected so it is only exposed to pipelines on protected branches.

Can a CI server read my secrets without a device key?

No. The API only ever returns encrypted values. A pipeline needs a device key that has been given access to the environment, the same as a teammate's laptop. If the key is missing or has not been shared that environment, the pull stops with an Unable to decrypt environment key error.

Is there a REST API?

Yes. The CLI is built on the SecretStash REST API, and you can call it directly from your own scripts. Requests are authenticated with a bearer token (the same kind of API token the CLI uses, issued through Laravel Sanctum), and variable values come back encrypted. Your script has to decrypt them with a device key, exactly as the CLI does, so the API is best suited to tooling that already uses the CLI's key files.

The API covers listing an application's environments, creating environments, and listing, creating, updating, and deleting variables. Command reference and setup guides are at docs.secretstash.cloud.

Which integrations are coming next?

Docker Secrets, Kubernetes, and AWS Secrets Manager sync are on the list, and none of them are available yet. Contact us if you need a specific integration, since requests shape what gets built first.