---
title: "Secrets, Signing & Git"
description: "Versioned secrets vault, signing identity management, and Git provider connections."
category: "Cloud Platform"
url: "https://bloom-platform-ten.vercel.app/docs/cloud/secrets-and-signing"
last_updated: "2026-08-16"
---

# Secrets, Signing & Git

> Everything the build farm needs to compile and sign your app, stored so that nothing sensitive is ever re-exposed by accident. Open the dashboard at [cloud.bloom.dev](https://cloud.bloom.dev).

## Secrets Vault

Secrets are scoped per environment and versioned—saving a new value creates a new version rather than mutating the old one, so you can roll back a secret the same way you'd roll back a release:

```bash
# Set a secret for an environment (never printed back to the terminal)
bloom cloud secrets set STRIPE_SECRET_KEY --environment production

# List keys (values always masked)
bloom cloud secrets list --environment production
```

The dashboard never renders a previously-saved value. "Reveal" performs a fresh, on-demand fetch and the plaintext never persists across a page reload.

## Signing Identities

Upload once per app and every build on the matching platform picks it up automatically. Identities within 30 days of expiry are flagged, expired ones are blocked from new builds:

- **Android Keystore**: `.jks`/`.keystore` with alias and passwords for signed release builds.
- **iOS Certificate**: Distribution certificate (`.p12`) for App Store / TestFlight builds.
- **Provisioning Profile**: Paired with a certificate to authorize device installs and capabilities.
- **API Key**: App Store Connect / Google Play service account keys used by the build farm to publish.

Downloading a signing identity is restricted to Release Manager and above.

## Git Connections

Connect GitHub, GitLab, or Bitbucket at the organization level, then link individual apps to a repository. Branch deploy policies map a branch pattern (e.g. `release/*`) to an environment, so pushing to the right branch is enough to trigger a build. Every inbound webhook delivery is logged with its event type and status, and can be replayed from the dashboard.

## Related Documentation
- [Cloud Platform Overview](https://bloom-platform-ten.vercel.app/docs/cloud/overview.md)
- [Build & Release Pipeline](https://bloom-platform-ten.vercel.app/docs/cloud/build-and-release.md)
- [Open Cloud Dashboard](https://cloud.bloom.dev)