DevOps and integrators onboarding
Passwork is a programmable secret store with an API-first architecture. Every operation available in the web interface is likewise available via the REST API, CLI utility, and Python SDK — the web interface itself calls the same endpoints.
This guide covers the Passwork features that are most relevant for DevOps engineers and integrators:
- Configuring service accounts and API tokens for automation
- Designing vault and folder structure optimized for CI/CD access
- Injecting secrets into processes and pipelines via Passwork-CLI
- Integrating with Python scripts and automated workflows via the Python connector
- Integrating Passwork with GitLab CI, GitHub Actions, Kubernetes, and Bitbucket Pipelines
- Automating secret rotation
If you also need to deploy and operate the Passwork server itself, see Infrastructure deployment and operations in the Admin rollout playbook section.
Two roles, one toolset
| Role | Primary tasks | Primary tools |
|---|---|---|
| DevOps engineer | CI/CD secret injection, automated rotation, infrastructure orchestration | Passwork-CLI, Python SDK, REST API |
| Integrator | Application-level integration, custom tooling, data pipelines | Python SDK, REST API, Passwork-CLI |
Both roles work with the same Passwork API and toolset. The difference is mainly in scope: DevOps engineers focus on pipelines and infrastructure secrets; integrators focus on building programmatic workflows on top of Passwork.
Key concepts
Service account — a dedicated Passwork user created for automation. Never use a personal account for CI/CD or scripts. Service accounts have their own token pair, their own role with minimal permissions, and their actions appear separately in the audit log.
Token pair — every API session uses two tokens: accessToken (short-lived, used in request headers) and refreshToken (long-lived, used to obtain a new access token). Store both securely.
Vault / folder structure — Passwork organizes secrets in a hierarchy: vault → folder → item. For automation, design this hierarchy by environment (production, staging, dev) and service type so that a single --folder-id can fetch all secrets a pipeline needs.
Client-side encryption (CSE) — when CSE is enabled, secrets are encrypted on the client before reaching the server. The CLI and Python SDK handle CSE transparently when PASSWORK_MASTER_KEY is provided. If CSE is disabled, the --master-key parameter can be omitted.
Quick-start checklist
| Step | Action | Page |
|---|---|---|
| 1 | Create a service account with a scoped role and generate the token pair | Service accounts and tokens |
| 2 | Design vault and folder structure for infrastructure secrets | Vault structure for DevOps |
| 3 | Install Passwork CLI and verify secret injection works locally | CLI and secret injection |
| 4 | Add service account credentials to your CI/CD platform | CI/CD patterns |
| 5 | Wire up the Python connector if you need script-level integration | Python connector |
| 6 | Set up secret rotation for time-sensitive credentials | Secret rotation |