---
path: onboarding/devops-onboarding/intro.mdx
title: DevOps and integrators onboarding
sidebar_label: Overview
sidebar_position: 1
slug: devops-onboarding
pagination_next: null
pagination_prev: null
description: >-
  Onboarding guide for DevOps engineers and integrators: using Passwork as a
  programmable secret store for CI/CD pipelines, infrastructure automation,
  and application integrations via CLI, Python SDK, and REST API.
keywords:
  - Passwork
  - DevOps
  - integrator
  - CI/CD
  - secret store
  - service account
  - API token
  - CLI
  - Python connector
  - automation
---

Passwork is a **programmable secret store** with an API-first architecture. Every operation available in the web interface is likewise available via the REST API, CLI utility, and Python SDK — the web interface itself calls the same endpoints.

This guide covers the Passwork features that are most relevant for DevOps engineers and integrators:

- Configuring service accounts and API tokens for automation
- Designing vault and folder structure optimized for CI/CD access
- Injecting secrets into processes and pipelines via Passwork-CLI
- Integrating with Python scripts and automated workflows via the Python connector
- Integrating Passwork with GitLab CI, GitHub Actions, Kubernetes, and Bitbucket Pipelines
- Automating secret rotation

If you also need to **deploy and operate the Passwork server itself**, see [Infrastructure deployment and operations](../admin-onboarding/infrastructure-operations.mdx) in the Admin rollout playbook section.

---

## Two roles, one toolset

| Role | Primary tasks | Primary tools |
|------|--------------|---------------|
| **DevOps engineer** | CI/CD secret injection, automated rotation, infrastructure orchestration | Passwork-CLI, Python SDK, REST API |
| **Integrator** | Application-level integration, custom tooling, data pipelines | Python SDK, REST API, Passwork-CLI |

Both roles work with the same Passwork API and toolset. The difference is mainly in scope: DevOps engineers focus on pipelines and infrastructure secrets; integrators focus on building programmatic workflows on top of Passwork.

---

## Key concepts

**Service account** — a dedicated Passwork user created for automation. Never use a personal account for CI/CD or scripts. Service accounts have their own token pair, their own role with minimal permissions, and their actions appear separately in the audit log.

**Token pair** — every API session uses two tokens: `accessToken` (short-lived, used in request headers) and `refreshToken` (long-lived, used to obtain a new access token). Store both securely.

**Vault / folder structure** — Passwork organizes secrets in a hierarchy: vault → folder → item. For automation, design this hierarchy by environment (`production`, `staging`, `dev`) and service type so that a single `--folder-id` can fetch all secrets a pipeline needs.

**Client-side encryption (CSE)** — when CSE is enabled, secrets are encrypted on the client before reaching the server. The CLI and Python SDK handle CSE transparently when `PASSWORK_MASTER_KEY` is provided. If CSE is disabled, the `--master-key` parameter can be omitted.

---

## Quick-start checklist

| Step | Action | Page |
|------|--------|-----------|
| 1 | Create a service account with a scoped role and generate the token pair | [Service accounts and tokens](./service-accounts-and-tokens.mdx) |
| 2 | Design vault and folder structure for infrastructure secrets | [Vault structure for DevOps](./vault-structure.mdx) |
| 3 | Install Passwork CLI and verify secret injection works locally | [CLI and secret injection](./cli-and-secret-injection.mdx) |
| 4 | Add service account credentials to your CI/CD platform | [CI/CD patterns](./cicd-patterns.mdx) |
| 5 | Wire up the Python connector if you need script-level integration | [Python connector](./python-connector.mdx) |
| 6 | Set up secret rotation for time-sensitive credentials | [Secret rotation](./secret-rotation.mdx) |