---
title: Secret Manager - Quickstart
description: Learn how to quickly set up and manage secrets with Scaleway's Secret Manager. Follow our step-by-step guide to create secrets, define paths, and add versions effortlessly.
dates:
  validation: 2025-06-17
  posted: 2023-02-21
---
import Requirements from '@macros/iam/requirements.mdx'


Upon secret creation, you are prompted to choose a Scaleway-managed encryption key or specify an existing [Key Manager](/key-manager) key which will encrypt your data. This allows for secure and flexible encryption of your data, compliant with industry standards.

In this quickstart, we show you how to create a [secret](/secret-manager/concepts/#secret) within a [path](/secret-manager/concepts/#path), how to add an existing or a new [Key Manager](/key-manager) key. Then we show you how to add [versions](/secret-manager/concepts/#version) to your newly-created secret.

## Console overview
Discover the Secret Manager interface on the Scaleway console.
<GuideFlow src="https://app.guideflow.com/embed/8kozm23fwp"/>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization

## How to create a secret

1. Click **Secret Manager** in the **Security & Identity** section of the [Scaleway console](https://console.scaleway.com/) side menu.
2. In the **Region** drop-down, select the [region](/secret-manager/concepts/#region) in which you want to store your secret.
    <Message type="important">
     Secrets cannot be moved from one region to another after creation.
    </Message>
3. Click **+ Create secret**.
4. Add your secret:
    - Choose whether to add your secret manually or import it.
        <Message type="note">
         The maximum file size for your secret is 64 KiB.
        </Message>
    - Choose a [secret type](/secret-manager/concepts/#secret-types) and enter or upload your secret value.
5. Choose a Key Manager encryption key:
    - Scaleway-managed encryption key: requires no configuration on your side.
    - Manually-managed encryption key: an existing Key Manager key you have previously created.
6. Choose a [path](/secret-manager/concepts/#path) for your secret.
    <Message type="important">
      A [path](/secret-manager/concepts/#path) is the directory structure to access your secrets and their [versions](/secret-manager/concepts/#version). Each path **must be prefixed** with a slash.
    </Message>
7. Enter a name for your secret, and, optionally, add a description and tags.
8. Optionally, click <Icon name="toggle" /> to enable [secret protection](/secret-manager/concepts/#secret-protection).
9. Optionally, click <Icon name="toggle" /> next to **Enable single access** or **Enable Time to Live** to apply an [ephemeral policy](/secret-manager/concepts/#ephemeral-policy) to your secret and its versions.
    <Message type="important">
     - **Single access**: allows you to set your secret versions to **expire after one single access**.
     - **Time to Live**: allows you to set a time frame of up to one year, during which your secret versions are valid and accessible.
     - The ephemeral policy can only be applied to a secret at creation, and **cannot be removed** once applied.
     - Once applied to a secret, the ephemeral policy's settings will be applied to all the secret's versions (even those created subsequently).
    </Message>
10. Check the estimated cost and click **Create secret** to confirm. The **Overview** tab of your secret displays with information such as the region of your secret, its encryption key, the secret's ID, etc.

    <Message type="note">
      - You have created a secret on the go. The value of your secret is stored in its first version, which is [enabled](/secret-manager/concepts/#enabling-a-version) by default. At creation, your secret only has one version. Keep reading our quickstart to find out how to add more versions to your secret.
    </Message>

## How to add a secret version

1. Click your secret's **Versions** tab.
2. Click **+ Create version**. A pop-up displays.
3. Add your version:

    - manually
    - import it from a file
    - or click **Copy from latest version** to restore your latest enabled version

4. Optionally, if you have selected **Copy from latest version** and applied the **Single access** ephemeral policy to your secret, click **Copy from latest version** to acknowledge the information displayed in the yellow banner, and confirm.
      <Message type="important">
        - Restoring a former version of a secret where you have applied the **Single access** ephemeral policy counts as an access, meaning it will then be disabled and/or deleted depending on the policies applied.
        - By default, all your secret versions have the same type as the secret they belong to. You cannot change the type after you have created the secret.
      </Message>
5. Click the <Icon name="toggle" /> icon if you want to [enable](/secret-manager/concepts/#enabling-a-version) the version.
6. Click **Create version**. Your secret versions display.