The Secrets Manager is the platform’s trust anchor. It signs device certificates, stores and leases service secrets, and rotates both on a schedule — all behind a single API so no service ever ships a private key in its config.
Responsibility in one sentence
Be the only place credentials are minted, stored and rotated — and expose that as a narrow, auditable API.
Could not build diagram for model "example-iot".
Signs device X.509 certificates from a CSR.
Versioned, encrypted storage for service secrets and leases.
POST /sign — turn a CSR into a signed certificate.GET /ca/crl — fetch the current revocation list.The full contract is embedded on the Overview tab.
When a new device is provisioned, Device Management calls POST /sign to turn
the device’s CSR into a signed certificate. That step lives inside the broader
provisioning flow:
Secrets and certificates rotate every 90d by default. Rotation is non-breaking: the previous version stays valid until consumers have fetched the new one.