Cloud PlatformSecrets, Signing & Git

Secrets, Signing & Git

Everything the build farm needs to compile and sign your app, stored so that nothing sensitive is ever re-exposed by accident.

Open Cloud Dashboard

Secrets Vault

Secrets are scoped per environment and versioned—saving a new value creates a new version rather than mutating the old one, so you can roll back a secret the same way you'd roll back a release:

Terminal

bash

# Set a secret for an environment (never printed back to the terminal)
bloom cloud secrets set STRIPE_SECRET_KEY --environment production

# List keys (values always masked)
bloom cloud secrets list --environment production

The dashboard never renders a previously-saved value. "Reveal" performs a fresh, on-demand fetch and the plaintext never persists across a page reload.

Signing Identities

Upload once per app and every build on the matching platform picks it up automatically. Identities within 30 days of expiry are flagged, expired ones are blocked from new builds:

Android Keystore

Upload a .jks/.keystore with alias and passwords for signed release builds.

iOS Certificate

Distribution certificate (.p12) for App Store / TestFlight builds.

Provisioning Profile

Paired with a certificate to authorize device installs and capabilities.

API Key

App Store Connect / Google Play service account keys used by the build farm to publish.

Downloading a signing identity is restricted to Release Manager and above.

Git Connections

Connect GitHub, GitLab, or Bitbucket at the organization level, then link individual apps to a repository. Branch deploy policies map a branch pattern (e.g. release/*) to an environment, so pushing to the right branch is enough to trigger a build.

Every inbound webhook delivery is logged with its event type and status, and can be replayed from the dashboard if a build didn't trigger as expected.

Previous: Build & Release Pipeline Next: Hosting, Observability & Automation