Changelog

September '24 Product Update

Change Requests

We’ve heard from a lot of you about the struggle to keep secrets and configs in check, and we totally get it! Before Change Requests, teams had two big challenges:

1. Not the Right Access: Developers either had too much access, leading to permission sprawl and security risks, or too little, forcing them to create Jira tickets just to update a secret they couldn’t reach.
2. No Clear Review Process: Unlike code, secrets often go live without a thorough review, leading to potential mistakes or vulnerabilities.

That’s why we built Change Requests - to give secrets the same thoughtful review process as code. Now you can:

• Keep Access Tight: Developers can propose changes without needing direct access, preventing permissions from getting out of control.
• Ensure Proper Reviews: Changes to secrets go through a review and approval process, helping catch issues before they impact your environment.
• Track Everything: Every change is logged, giving you full visibility and accountability, which is a huge win for compliance!

How it Works:

Propose Changes: Anyone with a Viewer role can suggest updates or changes to secrets.

1. Review & Approve: A teammate with approval permissions reviews the changes. If all looks good, they hit "approve."
2. Apply the Changes: Once approved, the changes can be applied by the approver or author - triggering any webhooks or syncs you’ve set up.

Change Requests are live today for all workplaces on our Enterprise plan. Head over to our docs to learn more!

August '24 Product Update

Config Inheritance

Config Inheritance is live! Our new feature allows you to inherit all the secrets from other configs into new or existing projects, making reusing those common secrets easier. Any changes made in the parent project are pulled into the child project, including secret name changes, without copying and pasting. Users typically used Secret References as a great way to reuse the same value across multiple projects with the ability to change values in a single place. The downsides?

• To update the secret name, you have to change it in every project that has the reference.
• To add a group of values to new projects, you have to remember which project and config they are in and then add them to your new project.

It is live today so head over to your Doppler dashboard to check it out, or dive into our docs for more details!

Config Inheritance is available exclusively for Team and Enterprise plans. On our Developer plan? Try Team for free!

The ROI of Secrets Management: Maximizing Security and Efficiency

Check out our latest white paper on The ROI of Secrets Management. Learn how effective secrets management can save your team time, reduce security risks, and drive significant ROI. Dive into real-world examples and key metrics that showcase the tangible benefits for your DevOps and security teams!

July '24 Product Update

Log of Executed Webhooks

What else have we been up to?

• Addressed an unintended behavior that allowed recurring reminders from personal configs. This option is now correctly disabled.
• Added URL capture in webhook logs and made it easier to review webhook activities with improved table column widths.
• We've made some design tweaks to the projects page for a more streamlined and visually appealing experience.
• Tooltips now include value type errors, providing more transparent and more helpful information.
• Resolved an issue that was causing sync failures for some users with Bitbucket.
• Added support for KMS keys when syncing to AWS Parameter Store and Secrets Manager.

June '24 Product Update

Faster Value Type Validation, New 'Direct Reference' and XML Types, and CLI Improvements

Validating value types in the Doppler UI was time-consuming and limited. Now, with faster validation, new types like “Direct Reference” and XML, and support for reading and setting value types in CLI v3.69.0, your workflow is more efficient than ever. Head over to the Doppler dashboard to check it out!

What else have we been up to?

• Added support for syncing to account-level secrets in Harness.
• Users can now recover their Doppler accounts by generating a temporary recovery code using a valid Doppler CLI token if they lose access to their MFA device.
• Improved error messaging for Log Forwarding connections when expired SSL certificates are encountered.
• Added the ability to import secrets from one config into another via the Dashboard.

May '24 Product Update

Reference secrets across personal configs

Managing secrets across personal configs was challenging with no way to reference secrets or share values between them. Now, you can easily reference secrets in personal configs from other personal configs. This allows you to consolidate and manage your secrets more efficiently, reducing redundancy, and improving security. Head over to the dashboard to check it out!

What else have we been up to?

• Fixed a UX issue where the screen jumped when opening the value type menu on a config with many secrets.
• Workplaces with SCIM enabled can now manually invite and remove users with unverified domains by Workplace Admins.
• Fixed a highlighting issue where some options would not highlight with keyboard navigation or mouse hover.
• Updated our Supabase integration to honor the SUPABASE_ prefix and maximum secret size.
• Added support for the doppler secrets --raw --json format in the import secrets modal which allows value type and visibility to be set on import.
• Fixed a lag when editing secrets in large configs on Chrome for a smoother experience.
• AWS Lambda ResourceNotFoundException will now display a clearer error message like "Function not found: arn:aws:lambda:us-west-2:00000:function:Example”.
• Enhanced functionality around managing dismissed secrets for better readability by truncating long secret names, simplifying the display, and reducing visual clutter.
• Improved the Workplace and Account deletion flow experience to ensure clarity and ease of use for this critical action.

April '24 Product Update

Secret Value Types

Now, you can set the Value Type of a secret to ensure the value is in the right format when it is saved in Doppler. You can select to validate types like JSON, JSON5, YAML, and many more from the Doppler Dashboard. This feature is available to all plans today. Read more in our documentation or see the feature in action here.

Webhook Improvements

We’ve been busy improving Webhooks functionality with the goal of giving you more flexibility and control in how you work with Doppler. Here’s what we’ve released so far:

• UI Enhancements: We’ve made editing Webhooks directly within the UI possible.
• API Automation: You can now automate the creation and editing of Webhooks via our API.

What else have we been up to?

• Doppler CLI v3.68.0 is here and now supports doppler secrets set --visibility
• We’ve expanded our Getting Started page for new user onboarding to Workplaces with role-based access.
• Fixed an issue with the Cloudflare pages integration where syncs were failing with 400 errors.
• Made it easier to add a payment method by auto-opening the billing info form on the Billing page when clicking on an action to add a credit card from another page.
• Fixed issues that prevented workplaces from downgrading their plan due to Trusted IPs being used.
• Updated the 'Compare By Secret' feature to suggest secret names only from environments the user has read access to.
• Fixed an issue where a secret's visibility type could not be changed from restricted to masked if other changes had already been made to the secret.
• Improved the error handling in secret sharing from configs, revealing only the secret to be shared rather than triggering errors for restricted secrets not involved in the sharing process.
• Optimized load times across Workplaces by resolving an issue where the high project count in one workplace negatively impacted performance when switching between multiple workplaces.
• Enhanced the Compare page with fixes for scrolling on long secrets, improved empty state visuals, and streamlined the experience for hiding and showing secret values.
  

March '24 Product Update

Invisible Character Warnings

Ever spent hours debugging only to find out the culprit was an invisible character hiding in your secret value? Not anymore! Now you’ll see a warning displayed whenever leading/trailing whitespaces, invisible characters, or any non-standard characters are present, avoiding future headaches. Rest easy knowing that your secret values are exactly as they should be.

Service Account Tokens API

From generating new tokens to keeping tabs on existing ones, everything you need is now at your fingertips with the ability to fully manage Service Account Access Tokens through the Doppler API. This update not only simplifies token management but also introduces the capability to set expiration dates for each token. Perfect for those who are looking for more efficiency in their expanding projects and teams.

What else have we been up to?

• Added the ability to manage existing webhooks through an improved UI.
• Introduced a "Secrets not in root" filter in branch configs to expedite the identification and promotion of branch-specific secrets to the root config, enhancing config management efficiency.
• Adjusted API/CLI requirements for secret notes to better align with their global scope per project and secret name, enhancing data structure accuracy and user access verification without altering functionality.
• Implemented fixes for Fly.io machine restart errors, preventing restarts for machines with auto_destroy enabled to ensure uninterrupted service.
• Corrected user group member count display on user page and refined secret name validation error messages for improved clarity.
• When importing secrets from a file, masked secrets now correctly display whether or not their value has changed.
• Extended the domain verification confirmation period to 7 days, providing users with a wider window for domain verification processes.
• Expanded permissions for service tokens, now allowing those with write access to update notes associated with secrets
• Addressed a GCP Secret Manager integration issue where the maximum config size limit wasn’t being applied as expected.
• HASURA_GRAPHQL_BACKWARDS_COMPAT_NULL_IN_NONNULLABLE_VARIABLES added to the allowlist, ensuring compatibility with new Hasura Cloud GraphQL variables.
• Resolved dashboard and Postgres secret validation bugs, enabling easier creation of new secrets with the unmasked view type and validation of rotated Postgres secret names.
• Fixed reconnection issue affecting legacy AWS Parameter Store and Secrets Manager integrations
• Improved project navigation stability, eliminating the need for full page refreshes for access to new or renamed projects.
• Expanded API capabilities to include the creation of GitHub Actions syncs, facilitating automated workflows and CI/CD processes.
• Upgraded CircleCI integration to paginate contexts, ensuring comprehensive visibility over available contexts beyond the initial 20.

February '24 Product Update

Manage Groups in Terraform

The Doppler Terraform provider v1.6.0 is here, now with advanced support for managing users within groups. This significant update is tailored for scalability and efficiency, particularly for our enterprise-scale users, enabling more granular control and streamlined configuration of your environments.

Search by Secret Value

Say goodbye to the frustration of sifting through endless configurations to locate a specific secret. The ability to now search by Secret Value allows you to effortlessly paste a secret into the search bar and instantly pinpoint every configuration it's linked to, saving you valuable time. This feature is being rolled out to your workplace over the coming days.

What else have we been up to?

• Released CLI v3.67.0 with new configure flags command for customizing CLI behavior and enhanced security through addressed gosec issues.
• Enhanced the Render integration with service pagination and sorting, improving organization and accessibility beyond the initial 100 services and a new option to redeploy the Render service whenever your secrets are synced.
• Enhanced the Vercel integration with support for 'sensitive' environment variable types, with the option to now choose sensitive or encrypted , allowing for secure encryption and restricted access during the build stage, with 'sensitive' set as the default option for synced secrets.
• Improved SSO integrations ensuring seamless acceptance of workplace invites.
• Resolved an issue importing specific Hasura Cloud environment variables, ensuring seamless integration and configuration management.
• Released DopplerHQ/secrets-fetch-action v1.1.3 now upgraded to Node 20 for enhanced compatibility ahead of Node 16's deprecation in GitHub Actions.
• The API now supports filtering by email when listing group members and allows you to retrieve group memberships to verify whether users are part of a group.
• Upgraded the compare page to alphabetically sort secrets allowing for accurate organization of secrets and configs during comparisons.
• Updated global search results by removing the project list query limit, enabling workplaces with numerous projects to always locate their desired project efficiently.

January '24 Product Update

As January comes to a close, we're not just keeping up with resolutions, we're setting the bar higher. Keep reading to see how we turned ambitious goals into achievable realities!

The New Era of Doppler

We started off 2024 by letting go of our old look and unveiling a bold new era of secrets management: sleek design paired with an identity that reflects the enterprise security powerhouse we've become. Read about how we approached this project in this post from our Head of Design.

Doppler’s Gone Dark

We’ve released Dark Mode into our product dashboard. Our dashboard now seamlessly adapts to your OS system settings or you can personalize your view with a simple toggle from the new menu at the top right corner. Enjoy the dashboard in your preferred viewing experience!

What else have we been up to?

• Enhanced permissions around service token deletion to ensure a user must have access to the token’s project or config in order to delete it.
• We've enhanced your search experience! Previously, selecting a shortcut from the search box with the Enter key caused a full page reload. Now, we've streamlined the process to use client-side navigation, making your searches quicker and smoother without unnecessary page refreshes.
• Fixed an issue in Firefox which prevented selecting values in certain dropdown components
• Addressed a potential error related to SCIM name attribute updates, enhancing compatibility and preventing silent failures.
• Fixed an issue where rotated secret values could display stale values if they were actively being viewed when a rotation occurred.
• Fixed an issue to ensure promoting restricted and unrevealed masked secrets works as expected.
• Fixed an error that occurred when a user was attempting to reveal a secret that had been renamed but not saved.
• Corrected a bug that caused rounding errors with large numbers during secret uploads.
• Completed our migration to React bringing enhanced UI performance to the dashboard.
• Resolved an issue preventing dismissal of reminders in branch configs.
• Addressed a rare scenario that incorrectly allowed nested references.
• Resolved an issue in revealing secrets that could inadvertently rate-limit users.
• Made several UI improvements to CTA buttons as well as the Compare, secret visibility, and secret naming features.
• Enhanced error management for smoother Netlify and Railway integrations.
• Improved the config page experience by preventing the 'Action Required' list from reordering while typing.
• Resolved multiple issues with importing and managing Hasura Cloud environment variables (starting with HASURA_CLOUD).
• Resolved access issues for service accounts ensuring they can access projects they created.
• Introduced a feature to redeploy services impacted during Railway integration syncs.

December '23 Product update

• Fixed an issue where service accounts did not have access to projects they created.
• Continued our React migration with the Compare page in the Doppler dashboard.

Create Personal Configs and Manage Dismissed Secrets

As the year winds down and the chill sets in, we're heating things up with new updates. Dive in to discover how we're keeping your productivity hot even as the temperatures drop!

Create Personal Configs

Personal Configs are now available to users on all plans and are designed to alleviate these pain points by automatically creating a branch config for each developer that has access to that environment, such as the dev environment. This personal config is private, accessible only to that developer. Personal configs will also help standardize onboarding by allowing you to add a doppler.yaml file to your repo with dev_personal to auto-configure the Doppler CLI in development.

With Personal Configs automatically enabled in all new dev environments by default, the tedious tasks of manual creation, deletion, and conflict resolution of personal branches are a thing of the past. This not only streamlines your workflow but also bolsters security and individual efficiency, ensuring a smoother, more personalized, and conflict-free config management experience. Check out our documentation for more details and also learn how to enable Personal Configs on existing environments.

Manage Dismissed Secrets

To address this, we've introduced the ability to view and 'undo' dismissed secrets. This enhancement brings back crucial oversight, allowing you to easily manage and reintroduce previously dismissed secrets into the 'Action Required' section as well as a new Managed Dismiss Secrets option in the menu on each environment of a project. It's a vital step towards ensuring transparency and efficiency in your team's secrets management, keeping your projects streamlined and secure. Go the secrets editor page in a config to try it for yourself.

What else have we been up to?

• Creating a new role is now simpler with the ability to copy permissions from any existing built-in role. You can also compare the permissions of any role with those of another aiding in more precise access control.
• We’ve added new native sync integrations for Deno Deploy and Harness, making it even easier to manage your secrets within partner ecosystems.
• Kubernetes Operator v1.5.0 has been released with added support for syncing subsets of secrets from Doppler configs via a new secrets property.
• We've fixed a Preview Branch pagination issue with our Vercel integration sync that limited you to choosing from the first 20 branches. All preview branches are now selectable!
• Links in the Integration area of Workplace Settings now take you to the sync management page where you'll find the sync in question, improving workflow efficiency.
• Fixed an issue which was preventing AWS Postgres rotated secret integrations from being reconnected.
• Our React migration is in the final stages with our Integrations page now migrated to React. This expands on our commitment to improving site page performance.
• Fixed an issue where CircleCI syncs would fail with an Unknown Error (400) when attempting to sync to a standalone CircleCI organization with no external VCS attached.
• Improved secret value validation for AWS Parameter Store syncs enhancing visibility of potential issues and workflows.
• Enhanced sync integration error handling for both GitHub Actions and Vercel improving reliability.

Major updates to Webhooks, new Postman integration, Team plan add-ons, bulk invite teammates, and more.

Happy Halloween! 🎃 No tricks, just treats from us this month. Our latest product updates and features are so good, it's scary!

Enhanced Webhooks

Our latest update supercharges your CI/CD workflows by enabling automatic triggers whenever your secrets change, including via automated secrets rotation. Additionally, you can now set up webhooks on a per-config basis for easier management of multiple setups. Plus, we've added more details to activity and config logs whenever webhooks change to increase auditability. Webhooks work with a variety of platforms out-of-the-box to make it as easy as possible to set up.

Team Plan Add Ons

We’ve enhanced our Team Plan offerings to better suit the growing needs of organizations. Team plan workplaces now have the ability to unlock a few key Enterprise-grade features without leaving their current plan. Add-ons allow you to enable User Groups, Custom Roles, or a higher integration sync limit for just an additional $9/seat/month for each add-on. Head to your workplace Billing page to check them out.

What Else Have We Been up To?

• We’ve added a Postman integration to streamline your API development and testing process.
• Workplaces can now manage Fly.io, Heroku, CircleCI, and Terraform Cloud integrations with added API support.
• Invite multiple users to your workplace at once with our new bulk invite support by comma separating email addresses.
• The GitHub Action sync repository selection dropdown is now sorted by name to streamline setup.
• Fixed an issue with Laravel Forge syncs by resolving issues related to archived servers.
• Optimized system performance when deleting large projects, environments, and configs.
• Added API support for waiting to respond until the first sync completes when creating an integration sync.
• When SAML settings are modified, or logging services are disconnected, workplaces will now be notified via email.
• Experience a cleaner user interface with fixes for the config Copy Secrets menu in Safari and scroll issues on the Config page.
• Updated Activity Logs for added or removed config Webhooks to help Workplaces keep track of changes.
• Resolved issues with Github Actions and Heroku affecting new syncs being created.

Generate Secrets In-Dashboard, Centralize Your Integration Syncs, Manage Billing Options, Improved Access Controls, and More.

Fall is in the air, and we're falling head over heels for our latest product updates and features. Keep reading to harvest the benefits of what we've been cultivating.

Generate Secrets

There’s a new significant enhancement to your Doppler dashboard—the ability to generate secret values directly within the platform. You can now create secure, random secrets without the need to switch between different tools. Simply hover over the secret, then click the 'Generate' button in the action bar. This feature not only simplifies the secret generation process, but it also streamlines secret management for your entire team, centralizing the creation and access of secrets all in one convenient location.

Centralized View of Syncs

You now have centralized visibility of all your integration syncs directly from the Settings page. Gone are the days of clicking into each individual project and drilling down further to find out where your syncs are set up. Now, you can see all this information in one consolidated view, right from Settings. This update not only saves you time but also provides a clearer, more efficient way to view all of your syncs and their status.

Enhanced Secret Search

We've supercharged our global search functionality, located conveniently in the top navigation bar, to allow you to search for secrets by name across your entire Workplace. This isn't just a tweak; it's an enhancement designed to make using Doppler more efficient and user-friendly. No more sifting through projects or environments—find exactly what you're looking for, right when you need it, all from one central location. And we've got some even bigger search improvements on the way!

What Else Have We Been Up To?

• We’ve added new native sync integrations for Deno Deploy and Harness, making it even easier to manage your secrets within partner ecosystems.
• Terraform Doppler Provider v1.3.0 is live with support for terraform import along with new resources for managing Doppler groups, service accounts, and project access.
• Updated our AWS Secret Manager integration to allow you to configure Doppler to sync secrets with tags.
• For Team and Enterprise Workplaces using Terraform, we’ve enhanced your experience by doubling the Read Rate Limits on each plan.
• Introduced the capability to permanently redact previous versions of secrets from the version history tab for heightened security and compliance.
• The Workplace Billing page has been updated to allow you to add or update your billing address and Tax ID, such as a European VAT Number, directly—making invoice handling more efficient and compliant.
• As part of our ongoing effort to improve the user experience in Doppler, we've migrated our Users and Tokens pages to React, resulting in faster load times and enhanced responsiveness for more efficient secrets management.
• We've rolled out several new API endpoints, enabling you to fetch and manage individual or custom roles, manage groups, project roles, project members, and handle service accounts with ease.
• Managing members access to environments is now easier with our switch from a column view to a dropdown view, showing all environments available for you to choose from.
• Added an option to disable machine restarts for Fly.io integration syncs, allowing you to have full control over your service’s restart behavior.
• You can now easily search and sort projects by name in the dashboard, making it easier to find what you need.
• Fixed an issue with our DigitalOcean integration where empty env var values would break the sync.
• We've enhanced our webhook capabilities. You can now configure webhooks at the config level within each environment, giving you granular control over event triggers.
• You’ll now see project and config information in API responses when listing an integration’s syncs.
• We've separated Custom Roles into workplace and project categories for a more streamlined user experience.
• To elevate your Netlify sync experience, we've added support for 'all contexts,' enabling seamless synchronization across multiple environments.
• We've enhanced your controls by adding the ability to edit project access for groups and service accounts directly from their details page, simplifying user and service accounts management.

New API Endpoint, Updates to Vercel Integration

• Added a new API endpoint for managing groups.
• Updated our Vercel integration to add pagination for projects. Learn more about our Vercel integration.
• Added more visibility into features that need to be checked or removed before a workplace is able to downgrade its plan to prevent putting the workplace in an unexpected state.
• Fixed an issue that now allows users to create rotated or dynamic secrets without needing to create a static secret first. Learn more about Automated Secrets Rotation.

Updates to Groups Page, Secret Visibility Improvements, New API Endpoint

• Our React migration continues with our Groups page converting over. This is part of a push to make Doppler more consistent and to improve overall speed and performance. Learn more about Groups.
• Adding a new masked secret now automatically re-masks the value after saving it on the dashboard. Learn more about Secret Visibility Types.
• Added a new API endpoint for deleting a secret.
• Fixed an issue that was causing SSO buttons to render improperly.
• Fixed an issue that could make it appear as if syncs were stuck processing.

Doppler CLI v3.65.2

• We’ve released Doppler CLI v3.65.2, which includes various bug fixes for the tui. Learn more about the Doppler TUI.

Kubernetes Operator v1.4.0, Discord Logging Service, Bitbucket and Hasura Cloud Syncs

• Doppler Kubernetes Operator v1.4.0 has been released with support for all Kubernetes managed secret types and custom name mapping.
• We’ve added Discord as a notification service via the Discord Slack-compatible webhook. This will allow workplaces to send workplace Activity Logs to a Discord channel. Learn more about our Discord service.
• Added a native Bitbucket sync integration to use with Bitbucket Cloud Pipelines.
• Added a sync integration for Hasura Cloud.
• Added the ability to manage projects from the user detail page. This will allow Admins and Owner roles to manage project access for a specific user in one central place. Learn more about team management.
• Added a new API endpoint for listing service accounts. Learn more about Service Accounts.
• We’ve improved the design and experience on a workplace’s Billing page. We’ve eliminated the tabbed design that separated information and moved to a single-pane view for easier management and allow for easier access to past invoices. There’s more planned for this page, so stay tuned.
• Updated reserved secret names for our Heroku integration sync to include the secrets injected by the Heroku Dyno Metadata labs feature. Learn more about our Heroku integration.
• Fixed an issue where some workplaces were showing Trial Expired when they were on a plan in good standing.

CircleCI Integration Updated

• Updated the CircleCI integration to support syncing to CircleCI Contexts. Learn more about our CircleCi integration.
• Fixed an error where some users could not view the secrets page without the View All Integrations workplace permission.
• Fixed a bug where workplaces that are not charged automatically were flagged as past due if they had an open invoice even though the invoice may not be past due.

Secrets Tab Consolidated

• The advanced secrets and secrets tabs have been consolidated with an easy to use dropdown added for selecting the appropriate config. This brings rotated secrets into a more central place. Learn more about Secrets Rotation.

Terraform Provider v1.2.3, Gitlab Sync Integration, and Custom Roles Visibility

• Doppler Terraform Provider v1.2.3 has been released with support for secret visibility types. Learn more about secret visibility types.
• Our newest Python SDK is live with the launch of v1.0.0. Doppler's SDK provides convenient access to the Doppler API from applications written in Python.
• We’ve added a new sync integration for GitLab.com allowing you to sync directly from Doppler.
• Custom roles are now visible to all users within a Workplace. Learn more about our custom roles.
• Our React migration continues with our Team page now moving to React.

Kubernetes v1.3.0 Released

• We’ve released Kubernetes v1.3.0 to accommodate multi-tenancy use cases. Read the detailed release notes.

Updates to Terraform Sync Integration and Custom Roles Fix

• Renamed Terraform sync integration to Terraform Cloud, and docs link to Terraform Provider, to make things more clear. Learn more about our integrations.
• Fixed an issue with custom roles that was causing project templates to fail to import properly. Learn more about our custom roles.

Secret Version History Displayed

• We’ve added the ability to see a secret's version history displayed in a tab within the secret details drawer.
• Implemented UX improvements around features that require a plan upgrade. This should improve clarity on what features are available in a Workplace's current plan and what would be available in a plan upgrade. Learn more about our plans and pricing.

Doppler CLI Update

• Fixed error with the Doppler CLI when updating via winget. Learn more about our CLI.

Fly.io Integration Update

• Fixed an issue with the Fly.io integration where secrets were being set in the Machine spec erroneously and another where deleted and renamed secrets weren't being synced properly.

UI improvements to the New Project List View

• Made some UI improvements to the new list view on the Projects page. These included updating the focus background to match the hover background color and fixing a visual issue where project descriptions would sometimes wrap to the next line in the middle of a word.

Service Accounts Now Available on Team and Enterprise Plans

We’ve launched Service Accounts on our Team and Enterprise plans to help companies improve their programmatic experience with Doppler at scale.

Service Accounts are a cross-project authentication mechanism not associated with an individual user. Similar to Doppler users, Service Accounts can be granted project and workplace access, and will soon be compatible with groups. Under the hood, they are comprised of tokens that can be rolled or deleted anytime.

Ready to start using Service Accounts? Head over to your workplace’s “Teams” section to get started or check out our docs to learn more.

Supabase Sync Integration Fix

• Fixed an error handling issue with the Supabase sync integration.

View Projects in List View

• Viewing the projects page just got easier. We’ve added a new List View to the Projects page, and the ability to toggle between views, to make it easier to scan your projects.

UX Improvement to Getting Started Page

• Added automatic opening and closing of onboarding steps on the Getting Started page, shown to new users on the Developer plan, when users skip a step.

New Cloudflare Pages Integration and User Access Logs

• Added a User Access Log section to the User Details page. This allows you to view which configs and active masked secrets any user has accessed.
• We’ve added a new Cloudflare Pages integration. Users can now sync secrets between Doppler and Cloudflare Pages.

RSS Feed of the Changelog and Auto Update Support for the CLI via Winget Install

• We’ve created an RSS feed of the Doppler changelog available at www.doppler.com/changes/rss.xml.
• Added support updating the Doppler CLI installed via winget for auto-update in MINGW64 environments\n· Learn more about the Doppler CLI.

Improvements to Getting Started and Uploading Secrets

• The next task on the Getting Started page, shown to new users on the Developer plan, now automatically opens resulting in less clicks for users.
• Fixed an issue where users were shown onboarding steps for tasks which they did not have appropriate access permissions to complete.
• Fixed an issue where uploading JSON secrets via doppler secrets upload would result in an erroneous _ prefix on the secret name.

Doppler TUI, Updated CircleCI Integration, And More

New

• We’ve added a tui command to the CLI for editing secrets. This lets you move faster, is even easier to work with, involves less typing, and has all of the power of the CLI behind it. Learn more about the Doppler TUI.
• Added a new keyboard shortcut, Cmd+S, to save secrets when on the Config page.

Improvement

• Implemented Copy as primary action functionality when wanting to copy secrets to prevent downloading a file to the user's filesystem.
• Released a security improvement requiring users to confirm any changes to their workplace’s billing and/or security emails. This prevents workplaces from specifying an email address they don’t control and spamming it with unwanted emails.
• Updated our CircleCI integration's validation for API tokens to account for CircleCI's new token format. Learn more about our integrations.
• Improved visibility of user plan limits for the Developer plan when adding the 6th user to their team. Learn more about our plans and pricing.

Updated Limit Notification Text and Performance Improvements

• Fixed a performance issue that could cause errors when creating large numbers of branch configs under some conditions.
• Updated text user sees when they hit a plan limit to make it clearer to users that they can upgrade their plan to increase that limit. Learn more about our plans and pricing.

CLI Support for Winget and New API Endpoint

• Windows users have been asking us to rethink how our CLI is installed on Windows machines - improving the speed to installation and increasing efficiency. We had been blocked by our tooling support on this but had never forgotten about it. We are excited to announce that we have now added support for Winget to install our CLI using winget install doppler. Learn more about the Doppler CLI.
• Added a new API endpoint for listing a workplace’s currently configured integrations. Learn more about the Integrations List endpoint.

Fix to Activity Log Display

• Fixed an issue in the Activity Log where the old config name was not being displayed after the config had been renamed. Learn More about the Activity Log.

Plan Name and Free Trial Countdown Added to Navigation

• Fixed an issue where creating a project through the API would occasionally fail for users with certain custom roles. Learn more about Custom Roles.
• Added the plan name to the Workplace dropdown menu to help users know which plan is associated with the Workplace they are currently in.
• Added a countdown showing how much time remains in a free trial when the Workplace is in the trial period for the Team plan. Learn more about plans and pricing.

Updated Azure Key Vault Integration

• Fixed issue when using Compare where user could see environments but not secrets.
• Added support for using the Azure Key Vault integration using a Service Principal for authentication.

Timezone Fallback Added

• Added a fallback to the default timezone name if the timezone comes through in an unexpected format. This prevents users being blocked from logging in to the dashboard if their browser provides an unexpected format and would use GMT+1, GMT-2:30, GMT+5:30, etc.

Updates to Token Metadata API Endpoint, Environment Creation Permissions, Geolocation Enforcement, and More

• We’ve expanded the fields available in our token metadata endpoint. This endpoint now includes the token name, slug, type, token_preview, created_at, and last_seen_at fields. Learn more about this endpoint here.
• Users can now grant environment creation permissions without granting access to all environments or granting access to create configs. Learn more about team management here.
• Users will now be required to re-authenticate in the Doppler dashboard when changing countries.
• Fixed an issue where the sort order for secrets in the Action Required list wasn't always correct.
• Fixed an issue where the 'Learn More' links on new user Pro Tips weren’t always clickable.

Expanded Audience for Sync Error Notification and Timezone Improvements

• All users with sync permissions will now receive the email notification when deleting secrets from a config fails. Previously, only Admins and Owners received the notification.
• Fixed local timezone abbreviation issues that were occurring with non-ASCII characters.

Dashboard Login Improvements

• Fixed dashboard login issue that was affecting some users.
• Now accept UTC in addition to GMT in timezone abbreviation to address login issue for some users in France.

Improvements to Webhooks, Search, and Timestamps Display

• Webhook payload now will include modified secret names. Learn More about webhooks.
• Display friendly timezone name in timestamps instead of numeric timezone offset.
• Extended our search capabilities to now allow for searching for config names when there are more than 20 configs in a project.

Improvements to Deleted Secret Workflow, Activity Log Performance, Webhook Disabling Communications, and More

• The secrets page will now display a warning message when deleting a secret that is referenced elsewhere. This should improve awareness about where secrets are referenced. Learn More about secret referencing.
• Addressed locking errors that a couple of integrations were running into by moving to a different redis client.
• Now sending emails to all users with webhooks permissions when a webhook is disabled. We previously only emailed Workplace Owner and Admin roles. Learn More about webhooks.
• Updated the hover state on the Getting Started page, shown to new users, for each toggled section.
• Migrated the Activity Log page to React which brings performance improvements and allows for future UX changes.

Case name transform support

• Added support for kebab case name transforms.

Re-authentication Required When Geolocation Changes

• Users now required to re-authenticate if their geolocation data changes.

Improvements to Search UX and Engineering Fixes

• Improved search bar UX showing appropriate state of search and in results shown.
• Fixed issue where new user ProTip on Projects page would flicker.
• Now only send secret reminder emails to users with necessary permissions on the affected environment.

New API Endpoint, Updates to Fly.io Integration, and Engineering Fixes

• Added API endpoint for retrieving metadata about current token.
• Fly.io integration now automatically restarts Fly.io Machines under their V2 platform when secrets are synced.
• Fixed issue with search bar not showing correct content based on the current page the user is on.
• Fixed "reach out" links that were broken on the Billing page "Credit Card" and "Invoices" tabs.
• UX fix to misalignment of Account Authentication sections buttons by centering vertically.

Updates to Our Vercel Integration

• We’ve updated our Vercel integration to now allow up to 1000 secrets to be synced.

Fix for Sharing a Referenced, Restricted Secret

• Fixed an issue that caused an error when attempting to share a secret that referenced a restricted secret.

Doppler Share UI Updates

• Updated the Doppler Share UI to be more readable, improve performance, and streamline link sharing. Share is free to use and fully encrypted - use it to send sensitive data to anyone!
• Fixed an issue with was causing the rotated secrets modal to close unexpectedly. Learn more about our Secret Rotation beta.

Fix for Masked Secrets

• Fixed an issue which prevented users from saving imported changes to masked secrets. Learn more about secret visibility types.

Click-To-Reveal Secrets in Doppler and an Update to Terraform Cloud Sync

• Users can now click to reveal masked secrets in Doppler. This will help limit unnecessary secret reveals and improve audibility by only logging reads for secrets we're confident were seen by a user.
• Added support for name transforms with an update to the Terraform Cloud sync. There is now a new option when creating syncs to convert secret names to lowercase to better support Terraform variable naming conventions.

New DigitalOcean Sync Integration, Qovery Integration, and Improvements to Github Actions and Activity Logs

• We’ve added a new OAuth-based DigitalOcean App Platform sync integration. Users can now sync secrets to the DigitalOcean app platform and services will automatically re-deploy.
• You can now sync Doppler secrets to Qovery applications, containers or jobs with our new Qovery integration.
• Solved an issue where GitHub orgs with a large number of repos might experience timeouts when creating new Github Actions syncs. Learn More about our GitHub Actions integration.
• Improved messaging in Activity Logs when there is no log data available in the last 30 days.
• Updated our public API to support fetching only raw secret values.
• Activity Logs will now track the use of referral credits for a Workplace.

Doppler VS Code Extension Now Available

• The official Doppler VS Code Extension is now available on the Visual Studio marketplace. Users can read and write secrets directly from their IDE bringing secrets closer to where developers use them.

Monorepo Support for our CLI

• Improved support for setting up the CLI in monorepo projects. Learn more about our CLI.

Rotate MongoDB Atlas Passwords

• Secrets Rotation keeps getting better. You can now rotate MongoDB Atlas Passwords if your Workplace is on the Team plan or above.
• Added support for updating the CLI in linux-based Windows environments. Learn more about our CLI.
• Generating recovery codes is now part of enabling MFA.

Getting Started Page for New Users

We’ve revamped our new user onboarding with a dedicated Getting Started page. This will be shown to new users on our Developer plan with a future expansion to new users on all plans coming later.

Secret Visibility: More Control Over Your Secrets

Secrets can now be assigned a visibility - un-masked, masked, or restricted - giving Workplaces greater control over how and where a secret can be accessed from.

Terraform Cloud Sync Integration

• Secrets can now be synced to Terraform Cloud with our new Terraform Cloud Sync Integration. Users no longer need to figure out how to pull in secrets themselves with this native integration.
• Replaced the Authy SDK with a custom implementation that uses the Authy API directly. This reduces our code dependencies and addresses a vulnerability alert from the deprecated Authy package.

New User Tooltips

• Removed the in-product guided tour for new users and replaced it with native tooltips that users will discover as they navigate to new sections.
• Fixed an issue that was causing environments in the Doppler dashboard to appear out of order.
• Fixed an issue with Terraform which could cause errors when creating many Doppler configs concurrently in the same environment. Learn more about our Terraform integration.

Rotate GCP Service Account Keys, Assign Roles to User Groups, Leverage AWS Role Assumption, Create AWS Secret Manager Integrations with Terraform, and more!

• You can now rotate GCP Service Account Keys with Doppler! Workplaces on Team and Enterprise plans can now experience how rotating the underlying service account keys instead of the key object itself improves auditability and consistency within their infrastructure while maintaining a strong security posture.
• Use Terraform? Then you can now leverage our API or Terraform Provider to create AWS Secrets Manager Integrations + Syncs no matter what plan you’re on.
• Want to assign a default role to an entire User Group? Now you can! Enterprise workplaces can now assign a default role to any User Groups. When a user group is added to a project, its role will default to whatever was assigned. Didn’t assign one? The group will fallback to the workplace default role. Learn more about User Groups here.
• We’ve updated our AWS Secrets Manager and Parameter Store integrations to allow you to leverage AWS' preferred auth method of role assumption when setting up your integration. This allows users on any plan to improve their security posture by using the most secure method of integrating with AWS.
• Added a helpful safeguard to prevent users from entering notification service URLs (like Slack) as project webhooks.
• Added a link to the workplace Billing page for users on our Developer and Team plans to be able to request Doppler’s SOC 2 report.
• Various page load performance improvements
• Fixed a UI issue which caused some pages to appear completely blank when the browser window is very small
• Fixed an issue where clicking a Secret from the top search box would not correctly scroll to the Secret if it wasn't visible at that moment

Supabase and Github Actions Secret Synching, New Per-Secret Access History, SCIM fixes, and more

• We’ve added Supabase and GitHub Actions org secret syncing to our evolving list of integrations
• The Access Logs tab has now been replaced with a new per-secret read history access pane. On any config, you can click the access log icon to display the access pane and see who has viewed any version of a secret. Read more in our docs here.
• Improved autofocus when searching for a secret to help you find what you need faster.
• Fixed an issue with SCIM which caused all members to be removed from a group for some SCIM providers. Learn more about SCIM here.
• Fixed an issue with secrets referencing where self references could break when promoting a secret value to the root config. Learn more about Secret Referencing here.

New Workplace Create Experience

We’ve updated the experience for users creating new Workplaces. This improved UX brings improved performance and allows users to provide information to eventually personalize the next phase of their onboarding and allow them to get started faster.

Engineering Updates

• Multiple workplaces can now verify and setup SCIM against the same domain. Learn more about SCIM here.
• UI improvements to Secrets page to enhance performance. Learn more about our secrets engine.

Engineering Updates

• Advanced Secrets tab now disabled if user does not have correct permissions. Learn more about our Secrets Rotation beta.

Engineering Updates

• Updated our setup flow for GCP Secret Manager to allow users to narrow the permissions provided to Doppler's service account.
• UX updates to simplify our new user onboarding flow.

Secrets Rotation Beta Improvements

• Updated the usability of the rotation catalog. Learn More about Secrets Rotation.

Engineering Updates

• UX and performance improvements for Fly.io and Netlify integration users. Learn more about our integrations.

Engineering Updates

• We've added an engine for Cloud SQL secret rotation. Learn More.
• Increased secret limit for Fly.io integration users.

Engineering Updates

• Added support for revoking service tokens via their value (docs).
• Improved performance of the secrets save operation.
• Added token previews to the dashboard Service Tokens overview page. This is particularly helpful in identifying service tokens if you have the token's secret value but don't know which token it is.

Railway Integration

We’re excited to welcome Railway to our growing list of available integrations. Railway is an infrastructure platform enabling teams to provision infrastructure, develop with that infrastructure locally, and then deploy to the cloud. The Doppler and Railway integration ensures that secrets from a selected config will be immediately and continuously sync with Railway projects.

This integration is pre-built and doesn’t require any additional code to set up. You can learn more about the integration here.

Datadog Log Forwarding

We’ve added the ability to forward any action taken in Doppler directly into Datadog, providing greater insight into your teams activity across your infrastructure. To start forwarding logs to Datadog you’ll need to create a new API key for Doppler to use, and then enter that API key into Doppler. That’s it! Now all subsequent actions you take in Doppler will be forwarded to Datadog.

‍Prerequisites to get started:

• Ability to create a new Datadog API Key
• Ability to edit Doppler Workplace Settings
• Doppler Enterprise plan

Learn more about Datadog Log Forwarding in our guide.

Fly.io Integration

Today, we welcome Fly.io to the growing list of Doppler integrations. Fly.io is a platform for running full-stack apps and databases close to your users.

Doppler users will now have an easier way to leverage secrets in Fly.io. Our integration ensures secrets are securely synced to Fly.io any time you make an update to a Doppler config.

This integration is pre-built and doesn’t require any additional code to set up. You can learn more about the integration here.

Engineering Updates

• Anyone who has write-access on a secret will receive reminders attached to a secret. Learn More about user roles.
• Fixed a bug that prevented selecting and copying a secret value on the config log page.

Codefresh Integration

Codefresh integration now available. Learn More.

Engineering Updates

Fixed an issue with button loading state in Settings.

Engineering Updates

• Added new protections to the Workplace Settings page. Learn more about Workplace permissions.
• Updated setup instructions for Dynamic Secrets. Learn more about Dynamic Secrets.

Universal Import Now Available

Universal Import is now available for any partner site. Use Universal Import to push secrets directly to engineering services and production infrastructure with the click of a button. Learn more, get the code, and install from our Import hub.

Engineering Updates

• When a secret is imported via Universal Import, display in Activity Log. Learn more about Universal Import.
• UX improvements for secrets rotation. Learn more about Secret rotation.
• Automated rotation for Postgres is now available. Learn More.
• Improved logic for validating MySQL usernames. Learn More.
• Fixed issue with Azure AD SCIM not working due to auth error. Learn more about SCIM provisioning.

Search Improvements

The Cmd + K shortcut now triggers the search experience on the config page.

Automated Secrets beta and native Fly.io integration

• Automated Secrets rotation via API is now available in beta. Learn more about Secret rotation.
• The native Fly.io integration is now available. Learn More.

Search Improvements

Cmd + K can now be used to trigger the global search.

Renaming Secrets Fix

Fixed an issue that prevented secrets that had previously been renamed from being promoted.

Pull Requests Update

Once approved, a PR submitter can merge their own PRs. Learn more about Pull Requests.

Pull Requests Update

Users can now close any PR they open. Learn more about Pull Requests.

Pull Requests Update

Fixed an issue where a user couldn’t view PRs they’d submitted. Learn more about Pull Requests.

Improvement to Kubernetes integration

Fixed an issue where the Kubernetes Operator didn’t detect changes to referencing secrets. Learn more about using Doppler with Kubernetes.

Engineering Updates

• Optimized data management for User Groups. Learn more about User Groups.
• Fixed a Heroku integration issue that limits the number of Heroku apps shown during setup. Learn more about our Heroku integration.
• Fixed an issue that prevented GitHub Actions integrations from being created. Learn more about our Github Actions integration.

Universal Import

Launched essential flow for a new feature, Universal Import, currently in Internal Access.

Release date coming later this year. Learn more about Universal Import.

Announcing our Doppler SecretOps for Students Program

Doppler is now part of the GitHub Student Developer Pack, educating students with industry best practices for managing secrets.

Check out our announcement post to learn more.

Beta: Doppler Pull Requests

Utilize the familiar Pull Request workflow to make changes in Doppler. Reach out to support@doppler.com for access and check out the docs to learn more.

Support for retries in the Doppler Terraform provider

The Doppler Terraform provider will now retry requests up to 10 times to help combat intermittent request failures.

Mount emphemeral .env, JSON, or custom files using the CLI

The cli now support mounting a temporary file for applications to read secrets from. The file is automatically torn down when the doppler cli exits. Learn more here.

New! Custom Roles are generally available

Custom Roles allow an organization on the Doppler Enterprise plan to define roles to fit their specific use case - as granular as needed.

Native Render integration now available

Sync your secrets directly to Render with our new native integration. Learn more here.

New Doppler Terraform provider resources

The Doppler Terraform provider now supports projects, environments, and configs. Check out the docs here.

Dynamic Secrets for AWS IAM is available in beta

Provision AWS IAM users just-in-time with a defined TTL. Check out our docs to learn more.

Standardize your Doppler projects with Default Project Environments

Default Project Environments ensure consistency across all of your Doppler projects.

Forward activity logs to Splunk or Sumo Logic

Forward Doppler activity logs to Splunk or Sumo Logic to strengthen your SIEM posture.

Service Tokens Now Support Write Access

Service Tokens now support writes, expanding the possible use cases even further.

Drag and Drop to Import Secrets

Getting started with Doppler is even easier now that you can import your existing secrets via drag and drop with support for ENV, JSON, and YAML formats.

Configure CLI with Service Token via stdin

To prevent potential token leakage by malicious process list monitoring, the CLI can now be configured with a Service Token using stdin.

Group Project Membership

The Group detail page in the Team section now displays the list of Projects it can access.

Recurring Reminders

Have a secret that needs to be rotated monthly, say a database url? You can now configure recurring reminders on individual secrets in each environment.

User Groups

User Groups provide the fine-grained access controls required by large and enterprise organizations for managing Project ACLs at scale.

Learn more by visiting our User Groups documentation.

MFA Face ID/Touch ID Support iOS

Email and password accounts can now add a Face ID/TouchID MFA security key.

Doppler SAML SSO for Azure Active Directory

Enable Doppler SAML SSO for Azure Active Directory with our step-by-step guide to creating a Doppler AD Enterprise application.

https://docs.doppler.com/docs/azure-ad-saml.

Compare Secret Configs

In addition to comparing individual secrets, you can now diff two configs from the same project.

Ephemeral Service Tokens

It's now possible to create ephemeral Service Tokens by setting an expiration time.

Perfect for set-and-forget short-term access use cases.

GitHub Environments Support

Our GitHub Actions integration now supports syncing secrets to any GitHub Environment defined for that repository.

Promote Branch Secrets to Root Config

You can now promote individual secrets from a branch to the root config. No copy and paste required!

Discounted Pricing for Students and Non-Profits

We've updated our pricing to provide a 75% discount for students and non-profits for the lifetime of their account.

To get the discount applied create a workplace on the Team plan and then contact our support team to have the discount applied. That's it!

Heroku Integration Pipeline Apps Support

Our Heroku integration now supports syncing secrets for Pipeline applications.

Verify Doppler CLI Binary for Install Script

Installing the Doppler CLI using the install.sh script now supports binary signature verification using the `--verify-signature` flag.

Learn more by visiting our CLI installation documentation.

Remove Integration Flow

You can now choose whether to keep or delete secrets synced from Doppler when removing an integration.

Customize Name When Duplicating Config

You can now customize the name when cloning a Config in the dashboard and CLI.

Doppler CLI Alpine Package

The Doppler CLI can now be installed as an Alpine package.

Get installation commands at https://docs.doppler.com/docs/enclave-installation.

Config Integrations Tab

The new Integrations tab provides quick access to the connected integrations for a specific Config.

Secrets Sync for Cloudflare Pages Environment Variables

Learn how to sync Doppler secrets to Cloudflare Pages environment variables in a single command using our new Cloudflare Pages Environment Variables documentation.

Send Activity Logs to a Microsoft Teams Channel

You can now configure workplace activity logs to be sent to a Microsoft Teams channel.

See the Microsoft Teams documentation to learn more.

CLI v3.30.0 with improved auto-completion and fish shell support

Doppler CLI v3.30.0 has been released with new auto-completion enhancements and fish shell support.

Environment Specific Webhooks

Webhooks can now be scoped to a specific environment, perfect for triggering automatic redeploys on platforms such as Vercel and Netlify.

As an example, check out how to configure automatic production redeploys on Vercel using Doppler webhooks.

Download Secrets in YAML Format from the Dashboard

Secrets can now be downloaded in YAML format from the dashboard.

Reconnect Integrations

You can now easily reconnect an integration that is failing to sync from the project's integrations page.

CircleCI Integration Now Syncs Individual Secrets

We've made it easier to integrate Doppler into your CircleCI workflows by supporting the syncing of individual secrets.

Learn more at our CircleCI Integration documentation.

Force Sync Integration

In the event you need to test an integration, you can now trigger a sync manually from the integrations page.

Secrets Action Bar

We've improved the dashboard UI with our new secret action bar, putting operations such as comparing secrets just 1-click away.

Debugging Python Apps in Visual Studio Code

Check out our new guide that shows how to integrate Doppler with @VisualStudio Code for #Python applications using our new doppler-env Python package.

Learn more at our Visual Studio Code Python documentation.

Apply Secret Changes Across Multiple Environments

You can now apply secret changes across multiple environments with a single click! Especially handy when adding a new secret.

Team Page Search Filtering and Pagination

The new search filtering and pagination features on the Team page make it fast and easy to review access permission levels organization wide.

GitHub Integration Now Syncs Individual Secrets

It's now easier to manage your GitHub Action secrets using Doppler as our integration has been updated to support the syncing of individual secrets.

Learn more at our GitHub Integration documentation.

Multi-Environment Secret Updates

Updating secrets and config values across environments just got a whole lot easier with our new multi-environments update feature!

Smarter Doppler CLI Open Command

Our CLI doppler open dashboard command just got smarter, taking you directly to the project you're working in!

Upgrade the CLI to the latest version by running doppler update.

Achieving SOC 2 Compliance

Developers and organizations trust Doppler with securely managing and serving millions of secrets to their applications and we’re excited to announce that Doppler has achieved SOC 2 Compliance.

Read our announcement blog post to learn more.

Announcing the Doppler Share API

Doppler Share now has a public facing API that supports sending secrets to the API in plain-text or encrypted using an AES-GCM symmetric key (recommended).

Learn more at https://docs.doppler.com/reference#share-secret.

Secure Secrets Management for DigitalOcean Applications

Now you can securely manage secrets and environment variables for your DigitalOcean hosted applications with our DigitalOcean Marketplace App.

We're excited to be bringing our universal secrets management features to DigitalOcean and our embedded CLI injects secrets as environment variables for every language and framework.

Learn more at https://docs.doppler.com/docs/digitalocean.

Doppler 30% Off First 3 Months in Partnership with Founder Club

Doppler is proud to be partnering with @ProductHunt Founder Club to give eligible start-ups 30% off their first 3 months (up to $5,000) on any Doppler subscription.

Learn more at https://www.producthunt.com/founder-club.

Viewer Access Level

Doppler now has a permissions level of Viewer that provides read-only access to secrets. Any user with Viewer access must be explicitly added to each project.

Learn more in our Team Access documentation.

Secret Notes in Doppler Dashboard

Ever had the issue where you don't know what an app config or secret is for? Or what values are allowed?

Wonder no more, as you can now add notes for each secret in the Doppler dashboard.

Doppler CLI Shell Completion

The Doppler CLI v3.23.1 now has shell completion that will be automatically configured on install for all non-Windows distributions.

Existing CLI installations can add shell completion by running `doppler completion install`.

Doppler Share Dashboard Integration

Doppler Share is now integrated into the dashboard, allowing you to share a secret with a trusted external developer in just two-clicks!

Doppler Secrets Sync for CircleCI

Wish you could manage CircleCI secrets for every project from a single dashboard? Learn how in less than 5 minutes using our Doppler secrets sync guide for CircleCI.

Open the Doppler Dashboard from the CLI

Need to jump from your development environment to the Doppler dashboard? Don't manually open your browser—just run the doppler open command.

Check out our CLI Guide for more tips and tricks!

Manage Doppler Team access with Okta SCIM 2.0

Doppler now supports Okta SCIM 2.0 for automatically provisioning and managing user access on our Team subscription.

Learn more at https://docs.doppler.com/docs/okta-scim.

Azure App Services Secrets Sync Integration

We're excited to announce our new Azure App Services secrets integration, enabling you to centrally manage secrets for every Azure App Services application from the Doppler dashboard with secret updates synced instantly.

Doppler Secrets Sync for Kubernetes

Want a single source of truth for managing k8s secrets? Check out our new guide for syncing Doppler secrets to Kubernetes using the Doppler CLI, environment variables, or a mounted config file.

Learn more at https://docs.doppler.com/docs/kubernetes.

Doppler CLI Apple Silicon Support

Apple Silicon: One small step to convince yourself you need a new Mac. One giant leap for performance!

As of version v3.23.0, you can use the Doppler CLI at warp speed with our new native support for Apple silicon!

Announcing Doppler Share

We built this so anyone share secrets with end-to-end encryption without needing to create an account or jump through any hoops.

Try it now - https://share.doppler.com.

Doppler Secrets Referencing Autocompletion

Using secrets referencing, e.g ${SECRET_NAME} is now a breeze thanks to our new autocompletion UI, making it much easier to create a secret such DB_URL which combines all database secrets.

For example: postgres://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}

Learn more at https://docs.doppler.com/docs/enclave-secrets.

Doppler Secrets Sync for Cloudflare Workers

Using Cloudflare Workers? Check out our new guide for syncing Doppler secrets to Cloudflare with a single command you can easily integrate into your deployment workflow.

Learn more at https://docs.doppler.com/docs/cloudflare-workers.

Doppler CLI Configs Clone Command

Cloning a Doppler config is handy for troubleshooting, e.g cloning the QA environment to debug test failures, and you can now clone a config from the CLI with the doppler configs clone command.

New Secrets Download Formats

The Doppler CLI now supports downloading secrets in YAML format, as well as runtime specific variants such as docker and env-no-quotes for use in GitHub Actions.

Learn more by running doppler secrets download --help

Doppler Secrets Sync for Bitbucket Pipelines

Check out our new secrets sync guide for Bitbucket Pipelines that uses a custom CI environment and branch configs to manage secrets for every environment from a single, unified dashboard.

Learn more at https://docs.doppler.com/docs/bitbucket-pipelines.

Doppler CLI Update Prompt

Doppler Secrets Sync for AWS Lambda

Manually editing environment variables in the Lambda console can be a thing of the past with our new Doppler secrets sync guide for AWS Lambda.

Learn more at https://docs.doppler.com/docs/aws-lambda.

Doppler CLI Upload Command

Bootstrapping a project to use Doppler is now even easier, thanks to the new doppler secrets upload command. Supports uploading files in ENV and JSON formats.

Vulnerability Disclosure Program Now Public

We're constantly working with security researchers and professionals to improve our security posture and we invite you to collaborate with us by joining our public Vulnerability Disclosure Program.

Doppler Community Forum

Our shiny and new Doppler community forum, powered by the 100% open source @discourse forum is now live at https://community.doppler.com

December 2020 Updates

Doppler Donating to Reduce CO₂ Emissions

At Doppler, we believe in helping not just developers, but the world they live in. Starting today we are taking our first step to help make that a reality by committing to donating 1% of each subscription to the removal of CO₂ from the atmosphere.

doppler.yaml Repo Config File

Tired of telling your team what Doppler project and config they need to select for a repository? Add a doppler.yaml file to auto-select the project and config for your repo when running doppler setup. Learn more at https://docs.doppler.com/docs/enclave-project-setup#local-development.

Doppler CLI Now Using OS Keyring For Auth Tokens

Starting in v3.16.0, CLI Tokens are now securely stored in the OS Keyring instead of the file system for macOS, Linux, and Windows.

Service Token Format Includes Config Name

You can now see which config a Service Token belongs to as the config name is built into the Service Token value. Thanks to @alexbouchardd for the suggestion!

Easy Doppler CLI Upgrades

Keeping dev tools up to date is hard, but not so with the Doppler CLI! Starting in version v3.16.0 you'll be prompted (once) to update your version whenever a new release becomes available.

Integrating Doppler with GitLab CI / CD

Using GitLab CI / CD? Learn how to use Doppler to provide secrets to your CI / CD jobs in less than 5 minutes with our new secrets management guide for GitLab.

GitHub now scans for leaked Doppler tokens

GitHub now scans your repos for Doppler tokens. Tokens found in public repos will be automatically revoked, preventing exposed tokens from being used to access your secrets.

See the official announcement from GitHub at https://github.blog/changelog/2020-12-07-github-now-scans-for-leaked-doppler-tokens

AWS Secrets Manager Integration

Wish AWS Secrets Manager had a nicer UI for managing app config instead of a JSON blob? Why not use Doppler's dashboard to automatically sync config changes to AWS Secrets Manager with our new integration! Learn more at https://docs.doppler.com/docs/aws-secrets-manager

Doppler "Enclave" Renamed to "Projects"

Phil Karlton said, "naming things" was one of the toughest challenges in computer science. We agree, and thanks to our fantastic community and their feedback, we've changed the previous term "Enclave" in the Doppler dashboard and documentation to be "Projects. Much better!

Vercel Integration

Have a need for speed? Vercel is all about it! Now you can sync secrets from Doppler for every project, and environment with our new integration! Learn more at https://docs.doppler.com/docs/vercel

November 2020 Updates

GCP Secret Manager Integration

Using GCP Secrets Manager? Now Doppler can automatically keep your app config and secrets in sync across staging, production, and everything in-between using our new integration! Learn more at https://docs.doppler.com/docs/gcp-secret-manager

Netlify Integration

Deploying to Netlify? Now you can sync secrets from Doppler to Netlify for every project and environment with our new integration!

Learn more at https://docs.doppler.com/docs/netlify

GitHub Integration

Struggling to manage secret sprawl in GitHub Actions? You can now inject secrets from Doppler into your GitHub Action with our new integration. Learn more at https://docs.doppler.com/docs/enclave-github-actions

Invitation to Join our VDP Program

We’re trusted with serving millions of secrets to developers and their apps in a secure, performant, and reliable way. A love for security is built into the core of our DNA and you can help by joining Doppler's Vulnerability Disclosure Program at https://doppler.com/vdp

Custom Environments

We love how vocal our community is in telling us what they need to manage secrets more effectively, and the most requested feature by far, has been the creation of custom environments.

And it's now here! 🎉🎉🎉

Laravel Forge Integration

Deploying to Laravel Forge? Now you can sync secrets from Doppler to Forge automatically with our new integration! Learn more at https://docs.doppler.com/docs/enclave-laravel-forge-installation

Heroku Integration

Deploying to Heroku? Make life easy by having a single dashboard to configure all of your Heroku applications across different environments using our new integration, with changes synced instantly! Learn more at https://docs.doppler.com/docs/heroku

Feedback Modal in Dashboard

What is the shortest word in the English language that contains the letters: abcdef? Feedback! And that’s what we want to hear from you to make Doppler the best app config and secrets management tool by using the new Feedback widget, built right into our dashboard.

October 2020 Updates

Ryan Blunden joining the team as Developer Advocate!

We're thrilled to announce that Ryan Blunden is joining Doppler full-time as a Developer Advocate. He loves creating documentation, educational videos, presenting, and joined Doppler to help developers everywhere manage their app configuration and secrets securely, and easily.

Outside of work, it's music and motorcycles that keep him busy and his location in Brisbane, Australia means he's always living in the future, at least by PST anyway.

AWS Parameter Store Integration

Wish AWS Parameter Store had a developer experience like Doppler? Now it can with our new AWS Parameter Store integration. Instantly sync your app config and secrets! Learn more at https://docs.doppler.com/docs/aws-parameter-store

Doppler HQ

Doppler HQ is officially a thing, and while we do embrace remote first and pants optional programming, we love the camaraderie of working together in a physical space.

If you're in San Francisco, we'd love for you to stop by to chat about app config, secrets management, security, or you can get our CEO Brian to buy you a free Burrito!

Doppler CLI removes enclave prefixed commands

Unless your Barbara Blackburn, who types at 212 words per minute, you're probably like us and prefer fewer keystrokes. That's why we've simplified the Doppler CLI to remove the enclave prefixed commands, so for example, doppler enclave setup is now doppler setup.

Security.txt

Want to help improve Doppler's security? Our security.txt shares how to do so safely and securely.

August 2020 Updates

Universal CLI Updates

You can now run doppler update on any machine to automatically upgrade to the latest version. And it's lightning fast. Try it out!

Secrets Referencing

Have a ton of duplicate secrets? Now you can add your secret to just one config and then reference it from everywhere else!

Here's how:

• Within a config: ${STRIPE_KEY}
• Within a project: ${stg.STRIPE_KEY}
• Across projects: ${billing.stg.STRIPE_KEY}

Once you have a secret being referenced, if you change that secret all references to it will automatically update.

New Status Domain

In light of the recent Cloudflare DNS outage, we embarked on separating our status page infrastructure from our primary services. Our new status page is hosted at dopplerstatus.com and uses a different registrar and DNS provider than our doppler.com domain. This helps ensure that a domain-wide outage cannot bring down our status page.

July 2020 Updates

Enable/Disable Webhooks

Want to get notified in your service about changes in your configs? You can now easily setup webhooks and enable/disable them.

Welcome Ruud Visser 🔥

We are all super excited to introduce Ruud Visser to the Doppler team. Before joining Doppler, Ruud led backend API infrastructure at Instagram! We can't wait to see what he ships next.

If you are passionate about developer tools or security, we are hiring Full Stack Engineers, Security Engineers, Developer Advocates, and Designers. Come join us!

MFA: YubiKey support

We've rolled out support for our most requested MFA method: security keys! You can now use a YubiKey and other WebAuthn-based security keys as an additional factor during login. Security keys can be added in addition to OTP/Authy, and we support multiple keys from day one. One piece of personal advice: always add a backup key!

Members Can Now Leave A Workplace

Everyone should have a choice of if they want to be part of a workplace, regardless of their access. Now any user, including someone with member access, can leave a workplace.

Smarter Secret Names

Secret names are tricky to get right, you want them to be uppercased and use underscores to make sure they work everywhere. But remembering all these arbitrary rules isn't fun, so now you don't have to. Doppler will automatically map your secret names as you type, like converting a space to an underscore. Just type, we will handle the rest!

Hello JSON Upload

Storing your secrets in JSON? Well at least they aren't in an ENV file 😂. Now you can upload them in bulk with our JSON upload feature!

Project Slugs Reimagined

All new Enclave projects are now referenced by their name. This makes for a much smoother experience when interacting with our APIs and CLI.

Current projects will continue to use their existing slug. To switch an existing project to a name based slug, simply rename your project.

Lock your Enclave configs for added protection

After recently deleting the wrong test config, we were humbly reminded that accidents happen. This led us to build our newest feature: config locking. Locking an Enclave config prevents it from accidentally being renamed or deleted. To perform one of these actions on a locked config, simply unlock.

May 2020 Updates

Doppler CLI now available via GitHub Actions

The Doppler CLI is now a full-time CI resident! Check out the Action on GitHub Marketplace to start using it in your GitHub Workflows today.

A Self Updating CLI

For Homebrew users, you can now update the Doppler CLI with the doppler update command as of version 3.1.0.

Hello Root Configs, Goodbye Defaults

Welcome to a more intuitive way to manage your secrets. Root configs work just like defaults but also comes with service tokens, Heroku sync, versioning, and much more.

March 2020 Updates

Secret Substitution

Have you ever needed to combine secrets together? Maybe a shared hostname? Today you can reference secrets from within other secrets.

Additional OTP 2FA Setup Methods

We've added support for setting up OTP via a manual key. This is in addition to the primary method of scanning a QR code. If you haven't set up OTP yet, try it out today!

February 2020 Updates

All Clients are End of Life

…except for the new Doppler CLI. The legacy Node CLI and Node, Python, and Ruby clients will continue to work with our v1 APIs, but will NOT receive any security updates, bug fixes, or new features.

The new Doppler CLI is written in Go to ensure it remains lightweight, incredibly fast, and compatible on any OS without dependencies. Plus, it ensures your secrets are always encrypted.

UI Improvements

We've rolled out a bunch of UI improvements and paper cut fixes this month. Here are a few of the things the team has released so far:

• Improvement: Count the number of secrets currently displayed
• Improvement: Alert when adding a secret with a name that already exists
• Improvement: API Reference for creating service tokens
• Fix: Scrollbars no longer block secrets in config logs on certain browsers
• Fix: Don't show 2FA flow when logging in with Google Auth
• Fix: Feedback form now looks consistent across all pages
• Fix: Changes page has bullet points and support for code snippets
• Fix: Slack community link is working again

The Fastest Doppler Ever

We've reduced our total page size by ~98% and load time by ~35%. To accomplish this, we now cache all static, public assets for up to 1 year. Assets are also cached by our globally-distributed CDN, meaning assets will always be served from a location near you.

We content-address all of our static assets. This is a method of naming the asset based on its content, typically using a hash function. Content-addressing ensures immutability by guaranteeing that the asset's name changes whenever its content does. For example, instead of loading doppler-logo.png, we load something like doppler-logo-a24a706d.png.

This funky naming enables us to crank caching up to the max. We specify a cache policy of public, max-age=31536000, immutable, must-revalidate. Let's break down what this means:

• public allows the asset to be cached by your browser and by our CDN
• max-age=31536000 indicates the asset can be cached for 1 year
• immutable asserts that the content really doesn't need to be rechecked if unexpired (why we need this)
• must-revalidate ensures that the asset is re-requested once it expires

Evangelizing Two-Factor Auth

Our users trust Doppler with their secrets. In return, Doppler trusts users to take account security seriously. After all, the most secure systems are still only as secure as their weakest link.

To help improve account security for all users, we'll now prompt you to set up 2FA on your next login. We'll also do so after performing a password reset.

This helps ensure your secrets are shielded from poor password hygiene, which is an ongoing goal of ours.

Compare Secrets

Ever wanted to compare your database url or any other secret across development to production? With the Compare Secret feature, you can!

Activity Logs Diffs

See the changes your team makes whenever an Enclave config is updated! View the config log to go deeper into which values were modified.

CLI v2.0

This major release is packed with features for local development.

Here's one: doppler run now automatically keeps a local, encrypted backup of your secrets. If the Doppler API or your internet connection ever goes down, you'll still be able to boot your app.

Remember, the CLI only takes 3 steps to set up locally:

1. brew install dopplerhq/cli/doppler / scoop / docker / other
2. doppler login && doppler enclave setup
3. doppler run -- node server.js <- or whatever your app is!

For a full list of new features and breaking changes, check out the release notes.

(Ok, we cheated on step 2 with the &&. But we also included the installation, which we could've left out, just to show you how easy that is too!)

January 2020 Updates

Enclave Webhooks

Automate your infrastructure with webhooks from Doppler. Get notified when anything in your Enclave project changes.

Brownie Points: Doppler signs the webhook request with a secret you provide to verify it is coming from us.

2FA: OTP Support

Protect your account with OTP 2FA, an open standard for two-factor authentication.

Strengthening Service Tokens

To encourage best practices, service tokens are now only displayed once during initial creation. After creation, you'll need to generate a new service token to retrieve its value. This helps ensure that you're using a unique service token for each service.

Rename Secrets

We are excited to ship one of our most requested features: Renaming Secrets!

Multi-Line Secret Upload

Have you ever needed to upload a multi-line secret like a certificate? Now you can today!

Have I Been Pwned?

To help keep customers safe, we now securely check users' passwords against public data breaches. If your password has previously been exposed in a data breach, we'll display a notice during login that requires you to change your password. More info:

We use the k-Anonymity model to anonymously and securely check if your password has been part of any past, public data breaches. Specifically, during login we now take a SHA1 hash of your password. The first 5 characters of this hash are sent to the popular Have I Been Pwned (HIBP) service. HIBP returns a list of all hashes it knows about that start with the same 5-character suffix. Our servers then compare each returned hash against the full SHA1 hash of the user's password. If there is a match, we prompt the user to change their password.

This process can only be performed during login and when changing your password because that's the only time Doppler has access to a user's plaintext password. We store bcrypt hashes of passwords in our database, meaning it would be computationally infeasible to perform this HIBP check at any other time. Additionally, the computed SHA1 hash is used only for the HIBP service and is never persisted outside of application memory.

We'll likely talk more about password security at a future date. For now, we encourage all of our customers to follow these best practices, as we do internally:

• Use a password manager for every account, regardless of its importance
• Always enable 2FA! (but ideally avoid SMS and Voice 2FA)
• Generate strong, random passwords with your password manager
• Never reuse passwords

🎉 New Year, New CLI

We're proud to announce the release of our new Doppler CLI! This release introduces some exciting new features:

• Forget about Doppler API Keys! Easier, more secure authentication with doppler login
• Manage all your connected devices from the Doppler Dashboard
• Simplified installation, including support for docker, brew, deb/apt, rpm/yum, and scoop. Also available as a standalone binary for Linux, macOS, and Windows.
• 40% faster and only ~3MiB small

All other Doppler client libraries have now been deprecated. This will allow us to more rapidly iterate on features and improve the productivity of our customers.

Thank you to all of our customers for another amazing year. We've got some enormous things cooking for 2020- stay tuned!

Thanks & Happy New Year! 🎉

September 2019 Updates

"CMD + Enter" to Save

Pro Tip: Save your secrets in Doppler with the CMD + Enter shortcut!

Multi-Line Secrets

Doppler now supports multi-line secrets such as certificates. Just paste and save!

May 2019 Updates

Navigate Faster

Powerful search gets you to where you want to go. Stay on your keyboard while navigating your workplace with "s" keyboard shortcut.

Diverged from Defaults?

Doppler's Defaults feature is the easiest way to roll out a new variable to your entire CI/CD pipeline. At a glance, see which variables in an environment are synced or diverged from Defaults.

All the Logs, Now on Slack

See your activity logs as they come in without ever having to leave Slack!

April 2019 Updates

Heroku Sync

On Heroku? Keep your app's config vars in sync with Doppler through automated 2 way sync. Setup Heroku Sync in under 2 minutes.

Documentation Hub

Checkout our new documentation hub! Explore the CLI and automate your flows with our API. Access the hub directly through the dashboard through the docs link.

February 2019 Updates

Secure View

Securely view your environment variables without worry of someone peeking over your shoulder...

Going SSO!

Using Single Sign-On providers like Okta or OneLogin? We have great news, you can now onboard your entire organization with our enterprise SAML SSO + JIT (Just In Time) feature. Request access today by reaching out to our enterprise team.

January 2019 Updates

File Upload

Upload your environment variables in bulk with file upload. Paste the contents of your .env and Doppler will handle the rest!

Launching 2FA

Protect your account from hackers with 2FA through our partner Authy. Enable 2FA today on your Doppler account by clicking here!

🎉 New Year, New Doppler

All traffic to doppler.market will now be redirected. Behind the scenes, here are some updates:

• Status Page is now dopplerstatus.com.
• Client Libraries now point to api.doppler.com.
• CLI ~> 1.0.15
• Node Client ~> 1.2.7
• Python Client ~> 0.0.19
• Ruby Client ~> 0.1.5

We're pumped to show you what else we have in store for 2019. Thanks for sharing with us the amazing feedback and the opportunity to make an impact on your journey.

For any comments, feedback, or support related questions, feel free to reach us at hello@doppler.com.

Thanks & Happy New Year! 🎉

December 2018 Updates

Status page

We believe in transparency at Doppler, especially something as important as your variables/secrets. To continue this effort, we are launching a status page.

October 2018 Updates

Lots of Logs

Have visibility over all workplace changes — from a bird's-eye view with Activity Logs and a worm's-eye view with Audit Logs.

Activity Logs

As workplace owners and admins, see how your team operates from a high level. From in-pipeline activity to user access modifications, Activity Logs show it all.

Audit Logs

Oftentimes, your teammates may suddenly update environment variables, and you don't know who changed what. Now, you can see who's making every change down to each character. If need be, the rollback feature comes in handy...

API Key Rolling

As of today, you can roll your Doppler API key as needed. For owners, the ability to roll any other teammate's API key on the team page is also available.

One-off API Keys

If you have external team members, like contractors, you're able to create one-off Doppler API keys that grant access to only a single environment.