You can now sync a project's keys to GitHub Actions, alongside Vercel, Supabase, and Cloudflare. Each ApiVault environment maps to a repository's secrets or to a named deployment environment.

To get started:

Open your project's Integrations page and select Connect GitHub.
Choose the GitHub account or organization to connect, and install ApiVault's GitHub App on the repositories you want to sync.
Link a repository and map each ApiVault environment to its repository secrets or to a deployment environment.

A mapping can name a deployment environment that doesn't exist yet. ApiVault creates it under the exact name you typed, and the sync preview lists it before anything is created.

#Changes made on GitHub

GitHub reports when each secret last changed, so ApiVault can tell when a secret it manages was edited there:

The key is still in the vault: the sync restores the vault value and reports the change.
The key was removed from the vault: the edited secret is left in place and reported as left behind.

Unlinking or disconnecting still removes everything ApiVault owns.

#Connections and credentials

ApiVault keeps only the installation ID and mints a short-lived token for each sync run. Reconnecting stays on the connection's own account, and reinstalling the app carries your repository links across instead of creating a second entry.

Sync errors now withhold a provider's message if it quotes a secret value, including in an escaped or URL-encoded form. This applies to GitHub, Vercel, Supabase, and Cloudflare.

Learn more in the GitHub integration guide.