Dashboard
The dashboard is where people manage access, structure, and history. Machines talk to Cloak through the CLI instead.
Secrets Editor & Bulk .env Import
Add/edit secrets with AES-256-GCM encryption. Bulk import .env files by copy-pasting raw key-values, or export with 1-click.
Environment Diff Matrix
Compare Development vs Staging vs Production in a side-by-side table. Instantly detect missing production keys before deployment.
Version History & Rollbacks
Every secret edit creates an immutable version tag. Inspect past versions in the slide-over history drawer and roll back in 1-click.
Role-Based Access Control (RBAC)
Assign Owner, Admin, Member, or Viewer roles. Viewers can read secrets without editing; Admins manage team access; Owners manage billing.
Tokens & Machine Access
Issue scoped machine tokens for CI/CD, set Read or Read/Write access, and set optional expiration dates.
Audit Log & Notifications
Every secret read, write, rollback, and team event is logged in a filterable timeline and exportable as CSV.
Command palette (⌘K)
Press ⌘K (or Ctrl+K on Windows/Linux) anywhere in the dashboard, or click the search box in the top bar. It jumps straight to any page, or triggers actions like Create workspace, New project, Create token, and Invite member without leaving where you are.
Notifications
The bell icon in the top bar shows recent activity relevant to you — a token you created, an invite you sent, or someone accepting an invite and joining your workspace. Opening the dropdown marks everything read.
Multiple workspaces
Click your workspace name at the top of the sidebar to switch between every workspace you belong to, or create a new one. If you were invited somewhere, that workspace shows up here automatically the first time you sign in — see Team & invites.
Reading the Audit Log
Every row shows who (a person or a machine token), what action, and which secret — but never the value itself. Use it to answer "who touched STRIPE_SECRET_KEY last week" without anyone needing to reveal it.
Install the CLI and inject secrets at runtime.
CLI reference