What the screen can claim

Why a managed key cannot drift, and what stays Kaisin's to decide about it.

The Vercel and GitHub connectors read a value’s type back to say whether it matches, differs, or drifted. Kaisin needs none of that: a managed key’s value can only ever be changed by the grant that manages it, so there is nothing for a person to have changed underneath it. orcakey.sh does not read values back from Kaisin to check; the write’s own answer — applied, removed, refused, rolled out — is the record.

Read-only where it counts

A managed key’s value cannot be edited or deleted in Kaisin, through the UI or through Kaisin’s own API, by a person’s session. Kaisin shows it as from orcakey.sh, with a link back to the environment that writes it, and the editor there says where to change it instead.

Scope, secret and public stay Kaisin's

What is not fixed is whether a key is needed at build time. Only Kaisin knows that, so a managed key’s scope (runtime, build or both), and its secret and public flags, are set in Kaisin and stay whatever Kaisin has them set to across every later push.

A new managed key arrives runtime-scoped, and not public. Whether it arrives secret depends on what it is in orcakey.sh: a secret arrives as a Kaisin secret; a key you have designated a variable arrives as an ordinary, non-secret value.

A build-time key must be non-secret

Kaisin refuses to store a build-time secret, because a value baked in at build time is readable from the built image regardless of how it is stored afterwards. So to use a managed key at build time — a NEXT_PUBLIC_* value, for instance — make it non-secret and build-scoped in Kaisin. A key left secret cannot be made build-scoped.

One rollout per push

A push that changes anything rolls out once, never once per key: a rebuild if a build-time key changed, otherwise a restart. A push whose values already match what Kaisin holds rolls out nothing.

Previews inherit

A PR preview built from a connected environment inherits its managed keys through Kaisin’s own inheritance, with nothing done in orcakey.sh. A preview built from a fork inherits nothing — Kaisin withholds every inherited variable from a fork PR, managed or not.