Collections

A collection is a label on a key. File DATABASE_URL under database and STRIPE_KEY under stripe, and the environment gains a structure you can hand out in parts.

Keys with no label belong to (uncollected). That is one state rather than an absence, so it can be included and excluded like any other collection.

What they are for

An environment usually holds keys for more than one thing. Collections let a consumer take the part it needs:

• The Kubernetes connector projects only the collections a workload needs, and kyvlt.sh never sends the rest. See Scoping to collections.
• A reveal can be limited to a collection, so the audit trail records what was actually looked at.

Filing a key

Set the collection when you create a key, or change it afterwards. It is a label on the key rather than a folder the value moves between: the value, its history and its name are untouched.

A collection exists because a key names it. Empty it of keys and it is gone.

They are not a permission boundary

A collection organises keys. It does not decide who may read them — that is the member’s role, and for a machine the environment its token is scoped to.