What the Kaisin connector is

The connector writes an environment’s keys into one application environment on a self-hosted Kaisin, so a running app or a build reads them with no one pasting a value into Kaisin by hand.

It runs when you change something. Save a key in a connected environment and the push is owed from that moment; a worker performs it a few seconds later, and Kaisin rolls the application out to match.

A grant, an alignment, a connection

Kaisin is self-hosted and single-workspace, so there is no install page and no console to register anything in. What lines up instead:

• The organisation connects one Kaisin workspace by typing the address it signs in at and approving a consent page on that Kaisin. What comes back is a grant: not a session, and not something that can sign in anywhere. See connecting for the scope it carries.
• A project is aligned to one Kaisin project and one application in it, both chosen from lists Kaisin returns.
• An environment connects to one of that application’s Kaisin environments — never a single PR preview — and is fed by one or more collections.

What a push does

A push sends the complete set of keys in the connection’s collections. Kaisin applies them, removes any managed key no longer in that set, and refuses a key it already holds from a person or from an attached resource — the rest still land. Nothing rolls out until the write lands, and then it rolls out once for the whole write: a rebuild if a build-time key changed, otherwise a restart, and nothing at all if nothing changed.

A key in no collection feeding the connection does not reach Kaisin.

Managed, not owned

A variable orcakey.sh writes is managed: Kaisin shows it as from orcakey.sh, and its value cannot be edited or deleted there. Its scope (runtime, build or both), and its secret and public flags, stay Kaisin’s to set, because only Kaisin knows whether a key is needed at build time. See what is true for exactly what that means for a build-time key.

PR previews inherit an environment’s managed keys through Kaisin’s own inheritance, with nothing done in orcakey.sh. A preview built from a fork inherits nothing, because Kaisin withholds inherited variables from fork PRs regardless of who wrote them.

Values in transit

A value goes to Kaisin over TLS, in the one request the push makes, and is not logged. Kaisin stores a secret value encrypted with its own protection, the same as a variable a person types in there by hand. orcakey.sh does not read values back from Kaisin to check they arrived; the write’s own answer — applied, removed, refused, rolled out — is the record.

What it never does

• It does not read from Kaisin into orcakey.sh. Every connector is one-way, outward.
• It does not touch a variable it does not manage. A person’s variable, or one supplied by an attached resource, is left exactly as it is.
• It does not expire the grant on its own. The grant lasts until revoked from either side; see connecting.