Secrets & Key Management · Integration
Doppler
Add Doppler to your product for your customers, and give your AI agents governed access to it.
Doppler's API at api.doppler.com/v3 has a hierarchy that every integration has to respect: a workplace holds projects, each project holds environments, and each environment holds configs, with secrets living on the config. Service tokens are scoped to a single config and are read-only by default, so a token that fetches secrets fine will fail the moment you try to write, while personal and service account tokens operate across projects. Branch configs inherit from their root config, so a secret fetched from a branch may be inherited rather than set locally, and deleting it locally reveals the parent value rather than removing it. Secrets can also carry references to other secrets, which means the raw and computed values in a response differ and you have to decide which one your consumer needs. fastn stores each customer's token at the right scope and handles upkeep as v3 changes.
In your product
Embedded for your customers. Per-tenant auth, no per-customer code, maintained by fastn.
Let a customer connect their own Doppler workplace and choose which project and config your product may read
Fetch a customer's configuration secrets at deploy time instead of asking them to paste credentials into your app
Write a rotated credential back into the right Doppler config when your product reissues it
Show which secrets in a config are inherited from a root config rather than set on the branch
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
Let an agent read the computed value of a named secret from a specific config, without listing the whole config
Have an agent write a rotated secret into a single config and confirm the change took effect there only
Audit, per tenant, every secret an agent read or wrote in Doppler, with the project and config it touched
Example prompt
Which secrets in our production config in Doppler are inherited rather than set directly?
Set up Doppler in 4 steps
- 01Enable the Doppler connector from your fastn dashboard.
- 02Have each customer authorise their own Doppler account, so calls run under their credentials rather than a shared key.
- 03Decide which secrets, keys and certificates your product needs, map those fields, then enable the actions and triggers you want.
- 04Call it from your product and expose it to your agents through the same governed connection.
Why teams use the Doppler integration
What you get by embedding it with fastn instead of building it yourself.
- Ship a Doppler integration without building it. Your customers connect their own Doppler account inside your product and work their secrets, keys and certificates there, with no per-customer code on your side.
- Handle the part that actually costs time: an expired certificate or an unrotated key is an outage rather than a warning, and it arrives without notice. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so a Doppler update is not your on-call problem.
- One integration serves your product and your agents. The same governed Doppler connection powers in-product features and gives AI agents scoped, audited access, so you fetch a credential at the point of use instead of storing it yourself without wiring it twice.
Used by these teams
Compare with
AWS Secrets Manager
AppViewXOften used alongside
Tools the same teams tend to run next to Doppler, across other categories.
ServiceNow
Datadog
PagerDutyDoppler integration FAQ
How do I add a Doppler integration to my product?
Enable the Doppler connector in your fastn dashboard, then let each customer authenticate their own Doppler account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no Doppler client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own Doppler account?
Yes. Every connection is scoped to the individual customer, so each authorises their own Doppler account and only ever sees their own secrets, keys and certificates. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this Doppler integration?
Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. Let an agent read the computed value of a named secret from a specific config, without listing the whole config
Who maintains the Doppler integration?
fastn does. When Doppler changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.
Does my product ever hold the customer's Doppler secret?
No longer than the call needs it. Values are fetched under the customer's own credentials at the point of use and never written into your database, and every read is logged per tenant so an access can be traced to what asked for it.
Can rotation and expiry be handled automatically?
Yes, within the permissions the customer grants, and audited. This matters more here than almost anywhere else: an expired certificate or an unrotated key takes something down rather than raising a warning first.
What can I build with the Doppler integration?
A common starting point: let a customer connect their own Doppler workplace and choose which project and config your product may read. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the Doppler integration cost?
It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding Doppler does not change your per-connector cost. You can start free with 3 connected accounts.
Add Doppler to your product
Start free with 3 connected accounts. No sales call required, and no per-customer integration code.