What the screen can claim
Why a managed key cannot drift, and what stays Kaisin's to decide about it.
The Vercel and GitHub connectors read a value’s type back to say whether it matches, differs, or drifted. Kaisin needs none of that: a managed key’s value can only ever be changed by the grant that manages it, so there is nothing for a person to have changed underneath it. orcakey.sh does not read values back from Kaisin to check; the write’s own answer — applied, removed, refused, rolled out — is the record.
Read-only where it counts
A managed key’s value cannot be edited or deleted in Kaisin, through the UI or through Kaisin’s own API, by a person’s session. Kaisin shows it as from orcakey.sh, with a link back to the environment that writes it, and the editor there says where to change it instead.
Scope, secret and public stay Kaisin's
What is not fixed is whether a key is needed at build time. Only Kaisin knows that, so a managed key’s scope (runtime, build or both), and its secret and public flags, are set in Kaisin and stay whatever Kaisin has them set to across every later push.
A new managed key arrives runtime-scoped, and not public. Whether it arrives secret depends on what it is in orcakey.sh: a secret arrives as a Kaisin secret; a key you have designated a variable arrives as an ordinary, non-secret value.
A build-time key must be non-secret
Kaisin refuses to store a build-time secret, because a value baked in at
build time is readable from the built image regardless of how it is stored
afterwards. So to use a managed key at build time — a NEXT_PUBLIC_*
value, for instance — make it non-secret and build-scoped in
Kaisin. A key left secret cannot be made build-scoped.
One rollout per push
A push that changes anything rolls out once, never once per key: a rebuild if a build-time key changed, otherwise a restart. A push whose values already match what Kaisin holds rolls out nothing.
Previews inherit
A PR preview built from a connected environment inherits its managed keys through Kaisin’s own inheritance, with nothing done in orcakey.sh. A preview built from a fork inherits nothing — Kaisin withholds every inherited variable from a fork PR, managed or not.