Provider catalog

A provider is where fnox gets a secret's value: ciphertext in fnox.toml, a cloud secret store, a password manager, or a store on your machine. Use this page to pick one, then follow its page for authentication and reference formats.

How providers work

You declare a provider instance under [providers.<name>]. The table name is yours to choose; type selects the implementation. Each secret names the instance it reads from:

[providers.op]          # instance name "op"
type = "1password"      # provider type
vault = "Engineering"

[providers.age]
type = "age"
recipients = ["age1..."]

[secrets]
DATABASE_URL = { provider = "op", value = "Database/url" }      # a reference into 1Password
LOCAL_TOKEN = { provider = "age", value = "YWdl..." }           # ciphertext, abbreviated

• Mix freely. One project can use any number of instances, including several of the same type (for example one per vault or region).
• Default provider. A secret without provider uses default_provider. When exactly one provider is configured, fnox uses it automatically.
• What value means depends on the type. Encryption providers store ciphertext; remote and local storage providers store a reference (a name, path or ID) and keep the value in their own store; the plain provider stores the value unencrypted in fnox.toml.
• Swap per environment. Redefine an instance in a profile to point the same secret names at a different vault or account.

Add an instance with fnox provider add <name> <type> or by editing fnox.toml, then check it with fnox provider test <name>.

Choose by need

You want to…	Use
Start without any account or service	age (quick start)
Commit encrypted secrets and share them by key	age, or a cloud KMS (AWS, Azure, GCP) to control decryption with IAM
Require a hardware key to decrypt	FIDO2, YubiKey, or an age plugin
Read what your team already keeps in a vault	1Password, Bitwarden, HashiCorp Vault, or your cloud's secret manager (existing vault guide)
Write secrets to a cloud store with fnox set	AWS Secrets Manager, AWS Parameter Store, Azure Key Vault Secrets, Google Cloud Secret Manager
Keep a personal or bootstrap credential locally	OS keychain
Read vault secrets offline or faster	Any provider plus a local sync cache or the daemon
Get short-lived cloud credentials	Credential leases, configured separately from providers
Integrate a system with no built-in provider	A Lua plugin

"Writes" in the tables below means fnox set KEY stores the value through the provider. For a read-only provider, fnox set KEY VALUE --provider <name> records VALUE as the reference instead; create the item in the provider's own app or CLI. fnox import currently accepts encryption providers only.

Encryption in config

fnox set encrypts the value and stores the ciphertext in fnox.toml. The config and public recipients can be committed; private keys and cloud credentials stay outside the repository.

Provider	Config type	Writes (fnox set)	Requires
age	age	Yes	An age or SSH identity, or an age plugin, to decrypt
FIDO2	fido2	Yes	The enrolled security key with hmac-secret support
YubiKey	yubikey	Yes	The enrolled YubiKey with HMAC-SHA1 challenge-response
AWS KMS	aws-kms	Yes	AWS credentials with encrypt/decrypt access to the key
Azure Key Vault Keys	azure-kms	Yes	Azure credentials with access to the key
Google Cloud KMS	gcp-kms	Yes	Google Cloud credentials with access to the key

Cloud and hosted stores

fnox.toml holds a reference; the value lives in the service, and the service's access policy decides who can read it.

Provider	Config type	Writes (fnox set)	Requires
AWS Parameter Store	aws-ps	Yes	AWS credentials
AWS Secrets Manager	aws-sm	Yes	AWS credentials
Azure App Configuration	azure-ac	No (read-only)	Azure credentials
Azure Key Vault Secrets	azure-sm	Yes	Azure credentials
Google Cloud Secret Manager	gcp-sm	Yes	Google Cloud credentials
Kubernetes Secrets	kubernetes	No (read-only)	Kubeconfig or in-cluster credentials with get on the Secrets
Bitwarden Secrets Manager	bitwarden-sm	Yes	bws CLI and a machine-account access token
Doppler	doppler	No (read-only)	doppler CLI, logged in or with a service token
FOKS	foks	Yes	foks CLI with a running agent
HashiCorp Vault	vault	Yes	vault CLI, a server address and a token
Keeper Secrets Manager	keeper-sm	No (read-only)	A Keeper Secrets Manager client configuration

Password managers and services

These read from a vault people already use. All of them are read-only in fnox: create and edit items in the password manager, then reference them.

Provider	Config type	Writes (fnox set)	Requires
1Password	1password	No (read-only)	op CLI, signed in or with a service account token
Bitwarden	bitwarden	No (read-only)	bw CLI and an unlocked session, or rbw
Enpass	enpass	No (read-only)	The local vault files and the master password
Infisical	infisical	No (read-only)	infisical CLI and a token or machine identity
Passwordstate	passwordstate	No (read-only)	Network access to the server and a list API key
Proton Pass	proton-pass	No (read-only)	pass-cli, logged in

Local stores and defaults

These use a store on your machine, or no storage beyond fnox.toml itself.

Provider	Config type	Writes (fnox set)	Requires
OS keychain	keychain	Yes	macOS Keychain, Windows Credential Manager, or Linux Secret Service
KeePass	keepass	Yes	A .kdbx file and its password (and key file, if used)
password-store	password-store	Yes	pass CLI and a GPG key
gopass	gopass	Yes	gopass CLI and an initialized store
Plaintext defaults	plain	Yes, as plaintext in config; No with file	Nothing. Only for values that are not secret

Custom providers

Provider	Config type	Writes (fnox set)	Requires
Lua plugins	lua	Yes if the plugin defines encrypt or put; otherwise No	A plugin file, directory or installed plugin

A Lua plugin can read, store or encrypt values with HTTP, JSON and command helpers, and can be shared as a git repository.

See also

• Use an existing vault: connect a password manager or cloud store and cache it locally.
• Configuration reference: fields shared by every provider, such as auth_command and daemon_cache.
• Provider commands: add, list, test and remove provider instances.