A password or private key cannot be exported or written directly
Symptom
You want to take a password or a private key out to a file, or write one through an import or an integration, and:
- when you export the Credentials list, the only matching field available is Has a secret, which says whether a secret is stored, but not the secret itself;
- after saving, the Password / secret field shows only asterisks;
- when you import into the vault, the secret column has no field to choose, and the entry ends up without a secret;
- a program connected through an integration receives one of the messages below.
Message
On the form of a vault credential, the screen warns:
“The secret is stored encrypted and is never shown here. Only people with permission can reveal it, and every reveal is recorded.”
The following messages are an internal safeguard: they never appear on screen, because the export windows do not offer these fields. Only a program connected through an integration receives them. When these fields are requested in an export:
“Vault secrets are never exported. Remove the secret from the list of exported fields.”
“The AT web-service password and the private key are never exported. Remove them from the list of exported fields.”
“The private key is never exported. Remove it from the list of exported fields.”
When writing in the wrong field, or searching by the value:
“The stored secret cannot be written directly. Use the “Password / secret” field: it is encrypted on saving.”
“The secret is write-only: it cannot be searched or filtered by value. Use the name or the owner of the entry to filter.”
“The web-service password and the private key are write-only: they cannot be searched or filtered.”
The first message and the asterisks come from the screen. The others were copied from the demonstration database in Portuguese, by attempting the operation through an integration.
Verified causes
- Secrets are stored encrypted. The value you type in their own field is encrypted on saving, and the list only keeps the indication that it exists.
- No profile exports them. The refusal also applies to the administrator. This way, an exported file never carries a password.
The AT public key is not a secret and is exported normally.
What to check
- What you really need: the value, or only to know whether it exists. To know whether it exists, export or look at the Has a secret field.
- Whether you have access: the vault (Accounting › Configure › Credentials vault › Credentials) is not shown to the Invoicing and Accountant profiles. See I do not have permission.
How to fix it
What you can do yourself:
- Store or change a secret: open the credential, type in the Password / secret field and save. See Credentials vault.
- Export the list: use Export as usual. The secret is not among the available fields, so the file comes out without it, only with Has a secret.
- Find a credential: search by Description, User name or Company. The secret cannot be searched.
What you ask someone else to do:
- AT credentials: the web-service password and the private key are written in the connection to the AT. Ask Fiscal administration or the administrator to follow Connect to the AT.
- Moving secrets to another server: there is no export, and the vault import does not bring the secret. Type them again at the destination, from the original source (the portal or the certificate file). Someone with permission can use Reveal secret, one credential at a time: it asks for the password again and is recorded.
Expected result
The export comes out without the secret field. After saving, the field shows asterisks.
When to contact support
- When saving, “This server has no encryption key for the credentials vault” appears: see The vault has no encryption key and, if it persists, contact support.
- A secret value appears in full in a list, a file or a message. Stop sharing that file and change the password.
Information to send
Follow How to ask support for help and what information to send, with the menu, the fields you chose and the full message. Never send the secret itself.