Keeper Secrets Manager (Preview)

Keeper Secrets Manager is a cloud-based, zero-knowledge secrets management platform for DevOps and IT teams. Securely retrieve, create, and update secrets (credentials, keys, passwords) stored in your Keeper Vault and automate secret lifecycle workflows.

This connector is available in the following products and regions:

Service	Class	Regions
Copilot Studio	Premium	All Power Automate regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD)
Logic Apps	Standard	All Logic Apps regions except the following: - Azure Government regions - Azure China regions - US Department of Defense (DoD)
Power Apps	Premium	All Power Apps regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD)
Power Automate	Premium	All Power Automate regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD)

Contact
Name	Keeper Security Support
URL	https://www.keepersecurity.com/support.html
Email	sm@keepersecurity.com

Connector Metadata
Publisher	Keeper Security - Logic Apps
Website	https://www.keepersecurity.com
Privacy policy	https://www.keepersecurity.com/privacypolicy.html
Categories	Security;IT Operations

Keeper Secrets Manager

Overview

Keeper Secrets Manager (KSM) is a cloud-based, zero-knowledge secrets management platform built for DevOps and IT teams. It enables organizations to securely store and programmatically access credentials, API keys, certificates, and other sensitive data — without ever exposing secrets in plaintext.

This connector bridges Keeper Secrets Manager with Microsoft Power Automate and Azure Logic Apps, enabling automated workflows to securely retrieve, create, and update secrets stored in a Keeper Vault. All secret access is authenticated through the Keeper Secrets Manager SDK and routed via a dedicated Azure Function middleware that your organization deploys and controls.

Key Features

Retrieve secrets on demand — fetch any secret by its unique record UID without hardcoding credentials in your workflows.
List all accessible secrets and folders — enumerate the secrets and folder structure your KSM application has been granted access to.
Create new secrets programmatically — provision login-type secrets directly from a Power Automate flow or Logic App.
Update existing secrets — patch one or more fields on a secret record without overwriting unrelated fields.
Zero-knowledge architecture — Keeper's SDK ensures that secret values are encrypted and decrypted client-side; neither Keeper nor Microsoft ever sees your plaintext secrets.
Least-privilege access — the KSM application you configure determines exactly which vault folders the connector can access.

Prerequisites

Before using this connector, you need:

A Keeper Security Enterprise account with the Secrets Manager add-on enabled.
A Keeper Secrets Manager application configured in the Keeper Vault or Admin Console, with at least one shared folder granted to the application.
A Base64-encoded KSM configuration token generated from the Keeper Admin Console (one-time use; treat it like a password).
An Azure subscription with permissions to deploy and manage Azure Function Apps.
The Keeper Secrets Manager middleware Azure Function App deployed to your Azure subscription — this is the backend the connector communicates with. Deploy it using the one-click Azure template or follow the azure-logic-apps repository README.
The Function App host key — used as the API key when creating a connection.

How to Obtain Credentials

Step 1: Configure a KSM Application

Sign in to the Keeper Vault.
Go to Secrets Manager > Create Application and give it a name (e.g., "Power Automate Connector").
Share one or more vault folders with the application. These folders define the scope of secrets accessible to the connector.
Open the Devices tab > Add Device > select Configuration File > choose Base64 format.
Copy the Base64 value immediately — this is your KSM_CONFIG. It is a one-time token; if lost, add a new device to generate a replacement.

Security note: The Base64 configuration value contains your application's encrypted credentials. Treat it like a password. Do not share it or commit it to source control.

Step 2: Deploy the Azure Function Middleware

Deploy the middleware to your Azure subscription:

One-click deploy: Deploy to Azure
Manual deploy: Follow the azure-logic-apps README

During deployment, paste your KSM_CONFIG Base64 value into the ksmConfig parameter. After deployment, note the Function App URL (e.g., yourfunctionapp.azurewebsites.net).

Step 3: Retrieve the Function App Host Key

In the Azure portal, open your deployed Function App.
In the left menu, select App keys (under the Functions section).
For least-privilege access, click + New host key, name it connector, and click OK.
Copy the generated value — this is the Function App Host Key used when creating the connector connection.

Step 4: Create the Connection

When adding the Keeper Secrets Manager connector to a workflow for the first time:

Enter the Function App URL — the hostname only, without the https:// prefix (e.g., yourfunctionapp.azurewebsites.net).
Enter the Function App Host Key retrieved in Step 3.
Click Create. All subsequent actions in the workflow reuse this connection.

Supported Operations

Operation	Description
List Secrets	Returns all secrets accessible to the KSM application, including UID, title, type, and folder UID.
Get Secret	Retrieves the full details of a single secret by UID, including login, password, URL, notes, and custom fields.
Create Secret	Creates a new login-type secret in a specified shared folder.
Update Secret	Updates one or more fields on an existing secret. Only provided fields are modified; omitted fields are unchanged.
List Folders	Returns all folders accessible to the KSM application, including UID, name, parent & folder UID.

Known Issues and Limitations

Login record type only for creation: The Create Secret operation supports the login record type. Other Keeper record types (SSH keys, database credentials, etc.) are not currently supported for creation through this connector.
One-time configuration token: The KSM_CONFIG Base64 token can only be used once for initial binding. After that, the middleware uses the derived configuration stored as an Azure Function application setting. To rotate, generate a new device token from the Admin Console and update the KSM_CONFIG application setting in Azure.
Folder creation not supported: Folders must be created in the Keeper Vault or Admin Console. This connector does not support creating folders.
Shared folder requirement: The folder_uid parameter in the Create Secret operation must reference a shared folder the KSM application has explicit write access to. Using an unshared or inaccessible folder returns a 400 error.
File attachments not returned: Secrets with file attachments are listed, but attachment binary content is not accessible through this connector.
Cold start latency: If the Azure Function App runs on a Consumption plan, the first request after an idle period may experience cold start latency (typically 2-5 seconds).
Rate limits: Request throughput is governed by your Keeper Security subscription tier and the Azure Function App's hosting plan (Consumption, Premium, or Dedicated).

Support

For assistance with this connector, contact Keeper Security Support or email sm@keepersecurity.com.

For issues with the Azure Function middleware, refer to the azure-logic-apps repository.

Creating a connection

The connector supports the following authentication types:


Default	Parameters for creating connection.	All regions	Not shareable

Default

Applicable: All regions

Parameters for creating connection.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Name	Type	Description	Required
Function App URL	string	The base URL of your deployed Azure Function App (e.g., yourfunctionapp.azurewebsites.net).	True
Function App Host Key	securestring	The host key or function key for your Azure Function App. Obtain this from the Azure portal under your Function App > App keys.	True

Actions

Create secret (Preview)	Creates a new login-type secret (record) in the specified Keeper Vault folder. Provide a title, login, password, URL, and optional notes.
Get secret (Preview)	Retrieves the full details of a single secret by its unique record UID. All record-type fields (login, password, URL, host, keyPair, paymentCard, etc.) are returned as flat top-level keys alongside notes, custom fields, and folder information.
List folders (Preview)	Returns a list of all folders accessible by the configured Keeper Secrets Manager application. Each folder includes its UID, name, and parent folder UID.
List secrets (Preview)	Returns a list of all secrets (records) accessible by the configured Keeper Secrets Manager application. Each entry contains the record UID, title, type, and folder UID.
Update secret (Preview)	Updates an existing secret identified by its UID. You can modify any combination of title, login, password, URL, and notes. Only the fields you include in the request body will be updated.

Create secret (Preview)

Operation ID:: CreateSecret

Creates a new login-type secret (record) in the specified Keeper Vault folder. Provide a title, login, password, URL, and optional notes.

Parameters

Name	Key	Required	Type	Description
Folder UID	folder_uid	True	string	The UID of the target folder where the secret will be created. Must be an accessible shared folder.
Title	title	True	string	The display title for the new secret.
Login	login		string	The login or username to store.
Password	password		string	The password to store.
URL	url		string	The URL to associate with the secret.
Notes	notes		string	Optional free-form notes to attach to the secret.

Returns

Body: CreateSecretResponse

Get secret (Preview)

Operation ID:: GetSecret

Retrieves the full details of a single secret by its unique record UID. All record-type fields (login, password, URL, host, keyPair, paymentCard, etc.) are returned as flat top-level keys alongside notes, custom fields, and folder information.

Parameters

Name	Key	Required	Type	Description
Secret UID	uid	True	string	The unique identifier (UID) of the secret to retrieve.

Returns

Full details of a secret record including login credentials, notes, and folder information.

Body: SecretDetail

List folders (Preview)

Operation ID:: ListFolders

Returns a list of all folders accessible by the configured Keeper Secrets Manager application. Each folder includes its UID, name, and parent folder UID.

Returns

Items: FolderArray

List secrets (Preview)

Operation ID:: ListSecrets

Returns a list of all secrets (records) accessible by the configured Keeper Secrets Manager application. Each entry contains the record UID, title, type, and folder UID.

Returns

Items: SecretSummaryArray

Update secret (Preview)

Operation ID:: UpdateSecret

Updates an existing secret identified by its UID. You can modify any combination of title, login, password, URL, and notes. Only the fields you include in the request body will be updated.

Parameters

Name	Key	Required	Type	Description
Secret UID	uid	True	string	The unique identifier (UID) of the secret to update.
Title	title		string	A new display title for the secret.
Login	login		string	A new login or username.
Password	password		string	A new password.
URL	url		string	A new URL to associate with the secret.
Notes	notes		string	New free-form notes.

Returns

Body: UpdateSecretResponse

Definitions

SecretSummary

Name	Path	Type	Description
Secret UID	uid	string	The unique identifier of the secret record.
Title	title	string	The display title of the secret.
Record Type	type	string	The record type (e.g., login, sshKeys, databaseCredentials).
Folder UID	folder_uid	string	The UID of the folder containing this secret.

SecretSummaryArray

Name	Path	Type	Description
Items		SecretSummary

SecretDetail

Full details of a secret record including login credentials, notes, and folder information.

Name	Path	Type	Description
Secret UID	uid	string	The unique identifier of the secret record.
Title	title	string	The display title of the secret.
Record Type	type	string	The record type (e.g., login, sshKeys, databaseCredentials, bankCard).
Notes	notes	string	Free-form notes associated with the secret.
Login	login	string	The login or username stored in the secret.
Password	password	string	The password stored in the secret.
URL	url	string	The URL associated with the secret.
Folder UID	folder_uid	string	The UID of the folder containing this secret.
Is Editable	is_editable	boolean	Whether the current application has permission to edit this secret.

CreateSecretResponse

Name	Path	Type	Description
Message	message	string	A human-readable success message.
Title	title	string	The title of the created secret.
Folder UID	folder_uid	string	The UID of the folder in which the secret was created.
New Secret UID	response	string	The UID of the newly created secret record.

UpdateSecretResponse

Name	Path	Type	Description
Message	message	string	A human-readable success message.

Folder

Name	Path	Type	Description
Folder UID	uid	string	The unique identifier of the folder.
Folder Name	name	string	The display name of the folder.
Parent Folder UID	parent_uid	string	The UID of the parent folder (empty for root-level folders).

FolderArray

Name	Path	Type	Description
Items		Folder