Items

The item types StackHangar stores, what each one holds, and how to add, edit, reveal, copy and delete an item.

An item is one thing a project depends on: a login, a key, a subscription, a domain. Each item belongs to one project and, optionally, one provider account. This page covers the item types and how to work with them.

#Item types

Type	What it holds
Login	A password for a provider account.
API key	A key or token, with an optional scope.
Database	A connection string, or a bare password with the engine, host and database name.
Subscription	A cost and how often it's billed. No value.
Domain	A renewal date and whether auto-renew is on.
Certificate	An expiry date (required).
Membership	A renewal date and a cost, such as a developer program.
Secure note	Free text kept as a value.

Logins, API keys, databases and secure notes hold a value. It is encrypted on your device before it is saved, and the server never receives it.

#Fields every item has

Name (up to 120 characters).
Project and Environment (Production, Staging or Development).
Provider and Provider account. See Accounts.
Where it's used: a comma-separated list of places, such as "Vercel project, GitHub Actions".
Expiry or renewal, or a rotation interval (below).
Notes.
Scope for API keys.
Cost and Per (month, year or other) for items that cost money.

#Add an item

There are four ways to add items:

Add item on the Vault page or a project page opens the Add one item tab of the Import page.
Paste a .env file or import a password manager export. See Import.
Save a key from the browser. See Capture.
Let a playbook or an agent request create it. See Playbooks and Secret requests.

In Add one item, pick the Provider and Type, choose or add the provider account, enter a Name, the Environment and the value, then set the reminder and select Save to vault.

#Expiry, renewal and rotate-every

Keys and databases usually have no natural expiry, so StackHangar asks how you want to be reminded. Expiry or rotation offers:

Rotate every 90 days, Rotate every 180 days or Rotate every 365 days
It expires on… with a date
Never expires (no reminder)
I don't know (flag as Hygiene)

StackHangar suggests a default for each provider, with a short hint. For example, it suggests rotating AWS keys every 90 days. A rotate-every reminder counts from the item's last rotated date, which is set to the day you add the item.

Domains, subscriptions, memberships and certificates use a Renewal date (certificates use Expiry date) instead.

When a date gets close, the item shows up on Home and you get an email. See Alerts and findings and Expiry reminders.

#Open an item

Select an item's name in the Vault or on a project page. The item page shows its details, a value card (for items with a value), and buttons to Rotate (or Renew), I think this leaked and Edit item. If the item is close to expiring the rotate button says Fix this. See Rotate a key.

#Reveal or copy a value

Values are always masked in lists.

Reveal shows the value for 30 seconds, then hides it again. Hide now hides it sooner.
Copy puts the value on your clipboard. On the Vault page you can copy without showing it. Clear your clipboard afterwards.

Production values are stricter. Revealing or copying a Production value needs a passkey check in this tab within the last 2 minutes, even when your vault is unlocked. These items show a Passkey needed every time badge. See Passkeys.

Decryption happens on your device only.

#Edit an item

Select Edit item. You can change the name, environment, provider account, date or Never expires, Rotate every (days), scope, places, cost, notes and, for a database with a bare password, the engine, host and database. Select Save changes.

To record that you rotated a key by hand, use Mark rotated on its finding on Home, or run the Rotate playbook.

#Seen by an agent

If an AI agent created or saw a key's value, you can mark the item with the agent's name. It then shows Seen by an AI agent and is flagged for rotation. Rotating the key clears the mark. See Agents.

#Delete an item

Select Delete, then Yes, delete. The item disappears from your vault and its reminders are cancelled. You can restore it from Recently deleted for 30 days.

#Filter the Vault

The Vault page lists every item. Search by name, provider, account or email, and filter by Project, Provider, Account, Type, Environment and Status (Expired, Due within 30 days, Healthy or No date set).

#If something goes wrong

"Passkey check didn't complete, so the value stays hidden." means the passkey prompt was closed. Try again.
"Couldn't copy automatically." means your browser blocked the clipboard. Reveal the value and copy it by hand.
If a save is refused because your history is full, see History.

Something missing or wrong on this page? Tell us.