Secret Manager App Backend Template
Environment Variables and Encrypted API Keys

Key Takeaways

Overview

A secure data management product needs to handle environment variables and API keys with encryption and access control.

This template defines secure vault capabilities with encryption and access control features so teams can implement secure data management quickly.

Why Build Your Secret Manager Backend with Back4app?

Back4app provides secure data management primitives so your team can focus on application security and integrity instead of infrastructure.

• •Secure data management: Utilize secure vault features to manage environment variables and API keys with encryption.
• •Access control features: Use ACL and CLP to restrict access to sensitive data and ensure data integrity.
• •Encryption and security: Encrypt sensitive information for enhanced security and compliance.

Build and iterate on secure data management features quickly with one backend contract across all platforms.

Core Benefits

A secure data management backend that helps you iterate quickly without sacrificing security.

Technical Stack

Everything included in this Secret Manager backend template.

ER Diagram

Entity relationship model for the Secret Manager backend schema.

erDiagram
    User ||--o{ Secret : "owner"
    User ||--o{ AccessLog : "user"
    Secret ||--o{ AccessLog : "secret"

    User {
        String objectId PK
        String username
        String email
        String password
        Date createdAt
        Date updatedAt
    }

    Secret {
        String objectId PK
        Pointer owner FK
        String name
        String value
        Date createdAt
        Date updatedAt
    }

    AccessLog {
        String objectId PK
        Pointer secret FK
        Pointer user FK
        Date accessTime
        Date createdAt
    }

Integration Flow

Typical runtime flow for auth, secure vault, environment variables, and API keys.

sequenceDiagram
  participant User
  participant App as Secret Manager App
  participant Back4app as Back4app Cloud

  User->>App: Login
  App->>Back4app: POST /login
  Back4app-->>App: Session token

  User->>App: List secrets
  App->>Back4app: GET /classes/Secret
  Back4app-->>App: Secret list

  User->>App: Create secret
  App->>Back4app: POST /classes/Secret
  Back4app-->>App: Secret objectId

  User->>App: Access secret
  App->>Back4app: GET /classes/Secret/{id}
  Back4app-->>App: Secret details

Data Dictionary

Full field-level reference for every class in the Secret Manager schema.

Security and Permissions

How ACL and CLP strategy secures environment variables and API keys.

Schema (JSON)

Raw JSON schema definition ready to copy into Back4app or use as implementation reference.

{
  "classes": [
    {
      "className": "User",
      "fields": {
        "objectId": {
          "type": "String",
          "required": false
        },
        "username": {
          "type": "String",
          "required": true
        },
        "email": {
          "type": "String",
          "required": true
        },
        "password": {
          "type": "String",
          "required": true
        },
        "createdAt": {
          "type": "Date",
          "required": false
        },
        "updatedAt": {
          "type": "Date",
          "required": false
        }
      }
    },
    {
      "className": "Secret",
      "fields": {
        "objectId": {
          "type": "String",
          "required": false
        },
        "owner": {
          "type": "Pointer",
          "required": true,
          "targetClass": "User"
        },
        "name": {
          "type": "String",
          "required": true
        },
        "value": {
          "type": "String",
          "required": true
        },
        "createdAt": {
          "type": "Date",
          "required": false
        },
        "updatedAt": {
          "type": "Date",
          "required": false
        }
      }
    },
    {
      "className": "AccessLog",
      "fields": {
        "objectId": {
          "type": "String",
          "required": false
        },
        "secret": {
          "type": "Pointer",
          "required": true,
          "targetClass": "Secret"
        },
        "user": {
          "type": "Pointer",
          "required": true,
          "targetClass": "User"
        },
        "accessTime": {
          "type": "Date",
          "required": true
        },
        "createdAt": {
          "type": "Date",
          "required": false
        }
      }
    }
  ]
}

API Playground

Try REST and GraphQL endpoints against the Secret Manager schema. Responses use mock data and do not require a Back4app account.

Uses the same schema as this template.

What You Get with Every Technology

Every stack uses the same Secret Manager backend schema and API contracts.

Frequently Asked Questions

Common questions about building a Secret Manager backend with this template.