Keeper Secrets Manager (Preview)

Keeper Secrets Manager is a cloud-based, zero-knowledge secrets management platform for DevOps and IT teams. Securely retrieve, create, and update secrets (credentials, keys, passwords) stored in your Keeper Vault and automate secret lifecycle workflows.

This connector is available in the following products and regions:

Keeper Secrets Manager

Overview

Keeper Secrets Manager (KSM) is a cloud-based, zero-knowledge secrets management platform built for DevOps and IT teams. It enables organizations to securely store and programmatically access credentials, API keys, certificates, and other sensitive data — without ever exposing secrets in plaintext.

This connector bridges Keeper Secrets Manager with Microsoft Power Automate and Azure Logic Apps, enabling automated workflows to securely retrieve, create, and update secrets stored in a Keeper Vault. All secret access is authenticated through the Keeper Secrets Manager SDK and routed via a dedicated Azure Function middleware that your organization deploys and controls.

Key Features

• Retrieve secrets on demand — fetch any secret by its unique record UID without hardcoding credentials in your workflows.
• List all accessible secrets and folders — enumerate the secrets and folder structure your KSM application has been granted access to.
• Create new secrets programmatically — provision login-type secrets directly from a Power Automate flow or Logic App.
• Update existing secrets — patch one or more fields on a secret record without overwriting unrelated fields.
• Zero-knowledge architecture — Keeper's SDK ensures that secret values are encrypted and decrypted client-side; neither Keeper nor Microsoft ever sees your plaintext secrets.
• Least-privilege access — the KSM application you configure determines exactly which vault folders the connector can access.

Prerequisites

Before using this connector, you need:

1. A Keeper Security Enterprise account with the Secrets Manager add-on enabled.
2. A Keeper Secrets Manager application configured in the Keeper Vault or Admin Console, with at least one shared folder granted to the application.
3. A Base64-encoded KSM configuration token generated from the Keeper Admin Console (one-time use; treat it like a password).
4. An Azure subscription with permissions to deploy and manage Azure Function Apps.
5. The Keeper Secrets Manager middleware Azure Function App deployed to your Azure subscription — this is the backend the connector communicates with. Deploy it using the one-click Azure template or follow the azure-logic-apps repository README.
6. The Function App host key — used as the API key when creating a connection.

How to Obtain Credentials

Step 1: Configure a KSM Application

1. Sign in to the Keeper Vault.
2. Go to Secrets Manager > Create Application and give it a name (e.g., "Power Automate Connector").
3. Share one or more vault folders with the application. These folders define the scope of secrets accessible to the connector.
4. Open the Devices tab > Add Device > select Configuration File > choose Base64 format.
5. Copy the Base64 value immediately — this is your KSM_CONFIG. It is a one-time token; if lost, add a new device to generate a replacement.

Security note: The Base64 configuration value contains your application's encrypted credentials. Treat it like a password. Do not share it or commit it to source control.

Step 2: Deploy the Azure Function Middleware

Deploy the middleware to your Azure subscription:

• One-click deploy: Deploy to Azure
• Manual deploy: Follow the azure-logic-apps README

During deployment, paste your KSM_CONFIG Base64 value into the ksmConfig parameter. After deployment, note the Function App URL (e.g., yourfunctionapp.azurewebsites.net).

Step 3: Retrieve the Function App Host Key

1. In the Azure portal, open your deployed Function App.
2. In the left menu, select App keys (under the Functions section).
3. For least-privilege access, click + New host key, name it connector, and click OK.
4. Copy the generated value — this is the Function App Host Key used when creating the connector connection.

Step 4: Create the Connection

When adding the Keeper Secrets Manager connector to a workflow for the first time:

1. Enter the Function App URL — the hostname only, without the https:// prefix (e.g., yourfunctionapp.azurewebsites.net).
2. Enter the Function App Host Key retrieved in Step 3.
3. Click Create. All subsequent actions in the workflow reuse this connection.

Supported Operations

Known Issues and Limitations

• Login record type only for creation: The Create Secret operation supports the login record type. Other Keeper record types (SSH keys, database credentials, etc.) are not currently supported for creation through this connector.
• One-time configuration token: The KSM_CONFIG Base64 token can only be used once for initial binding. After that, the middleware uses the derived configuration stored as an Azure Function application setting. To rotate, generate a new device token from the Admin Console and update the KSM_CONFIG application setting in Azure.
• Folder creation not supported: Folders must be created in the Keeper Vault or Admin Console. This connector does not support creating folders.
• Shared folder requirement: The folder_uid parameter in the Create Secret operation must reference a shared folder the KSM application has explicit write access to. Using an unshared or inaccessible folder returns a 400 error.
• File attachments not returned: Secrets with file attachments are listed, but attachment binary content is not accessible through this connector.
• Cold start latency: If the Azure Function App runs on a Consumption plan, the first request after an idle period may experience cold start latency (typically 2-5 seconds).
• Rate limits: Request throughput is governed by your Keeper Security subscription tier and the Azure Function App's hosting plan (Consumption, Premium, or Dedicated).

Support

For assistance with this connector, contact Keeper Security Support or email sm@keepersecurity.com.

For issues with the Azure Function middleware, refer to the azure-logic-apps repository.

Creating a connection

The connector supports the following authentication types:

Default

Applicable: All regions

Parameters for creating connection.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Actions

Create secret (Preview)

Get secret (Preview)

List folders (Preview)

List secrets (Preview)

Update secret (Preview)

Definitions

SecretSummary

SecretSummaryArray

SecretDetail

CreateSecretResponse

UpdateSecretResponse

Folder

FolderArray