Workplace Settings

The workplace Settings page is where you manage configuration that applies to your entire workplace. To open it, click Settings in the left navigation bar of the dashboard.

Access

Viewing the Settings page requires the View Settings permission, and changing most settings requires Manage Settings. By default, Admins can view the page and Owners can view and change it. Users without Manage Settings see the page in a read-only state, and some sections are hidden from them entirely. See Custom Roles for the full list of workplace permissions.

Workplace

The Workplace section holds your workplace's basic details. Click Save after changing any of these fields.

When you change the Billing Email or Security Contact, Doppler sends a verification email to the new address. The new address doesn't take effect until it's verified, and the section shows a notice while verification is pending. From that notice, you can click verify to complete verification or cancel to keep the current address.

You can also update these fields with the Workplace API.

Domains

The Domains section lists the domains your workplace has added. A verified domain restricts which email accounts can join your workplace and is required before you can set up SAML SSO or Email SSO. For each domain, the table shows its verification status and which types of SSO are configured for it.

Click the + button to add a domain. A workplace can have up to 15 domains. See Domain Verification for the full verification process.

Viewing this section requires the List Verified Domains permission. Adding, verifying, and deleting domains requires Manage Verified Domains.

SIEM Services and Communication Services

These two sections configure where Doppler forwards your workplace's Activity Logs:

• SIEM Services send security event data to your SIEM tools: Generic HTTPS, Splunk, Sumo Logic, Datadog, and AWS SQS.
• Communication services send real-time alerts about workplace activity to your team's chat tools: Slack, Microsoft Teams, and Discord.

Click Connect on a service to add a destination, or click + to add another destination to a service that already has one. Each destination can be edited, disabled, re-enabled, or deleted from its menu. Adding and changing destinations requires the Manage Settings permission.

Communication services are available on the Team plan and above. SIEM services are exclusive to the Enterprise plan. If your plan doesn't include a service, its card shows an Upgrade button instead of Connect. The number of destinations you can add across all services depends on your plan. See Platform Limits for details.

Project Features

The Project Features section controls features that apply to every project in the workplace. Change any of the options below, then click Save.

Secret Referencing

Controls whether secret referencing is available across the workplace. Set to Enabled by default.

You can't disable secret referencing while any secrets in the workplace reference other secrets. In that case, the option reads Disabled (remove references first) and can't be selected. Remove the references, then try again.

Changing this setting requires the Manage Secrets Referencing permission. Secret referencing can also be disabled for an individual project or config. See Disabling Secret Referencing for details.

Config Inheritance

Controls whether configs can inherit secrets from other configs. Set to Enabled by default.

You can't disable config inheritance while any configs inherit from other configs. In that case, the option reads Disabled (remove inheriting configs first) and can't be selected. Disabling config inheritance also turns off the inheritable status of every config in the workplace.

This option is only shown if your plan includes Config Inheritance and you have the Manage Config Inheritance permission.

Secret Naming

Controls which rules secret names must follow throughout the workplace. This setting applies to every project and config in the workplace. Every workplace uses Classic naming until an Owner switches it to Permissive.

There are two modes:

• Classic (default): Secret names must follow environment variable conventions. Names can only contain uppercase letters, numbers, and underscores, and can't start with a number. For example, DATABASE_URL.
• Permissive: Secret names can contain uppercase and lowercase letters, numbers, and the characters _, /, :, ., and -, and can start with a number. For example, database-url, payments/stripe.api_key, or 1password:token.

The following rules apply in both modes:

• Secret names can't contain whitespace, and can be at most 200 characters long.
• The names DOPPLER_PROJECT, DOPPLER_ENVIRONMENT, DOPPLER_CONFIG, and DOPPLER_CLI are reserved regardless of capitalization, and names can't start with DOPPLER_CLI_.

In Permissive mode, these exact names are also restricted: constructor, prototype, __proto__, toString, valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable, toLocaleString, __defineGetter__, __defineSetter__, __lookupGetter__, and __lookupSetter__.

Switching Between Classic and Permissive

To switch modes, select Classic or Permissive from the Secret Naming dropdown and click Save. Changing this setting requires the Manage Secret Naming permission, which Owners have by default.

Before switching, Doppler checks whether any existing secret names in the workplace break the rules of the mode you're switching to. If it finds any, the change is rejected and the error lists up to 10 of the secrets that need renaming. For example, if a workplace in Permissive mode has a secret named database-url, it can't switch to Classic until that secret is renamed to something like DATABASE_URL. Doppler doesn't rename secrets for you.

If some of those secrets are in configs you don't have access to, the error says so without naming them. In that case, ask someone with access to those configs to rename them, or ask a workplace Owner for help.

Every change to this setting is recorded in your workplace's Activity Logs.

Considerations for Permissive Names

Before you switch to Permissive, keep the following in mind:

• Environment variables: doppler run injects Permissive names into your application's environment exactly as they're written. However, names that contain ., /, :, or - aren't valid shell variable names, so you can't read them as $NAME in a shell script. Your application can still read them from its environment directly (for example, process.env["database-url"] in Node.js).
• Secret references: A secret reference uses . to separate the project, config, and secret name. To reference a secret whose name contains a ., wrap the name in double quotes. For example, ${"stripe.api_key"} or ${billing.prd."stripe.api_key"}.
• Integrations: Each integration still enforces the naming rules of the service it syncs to, regardless of your workplace's secret naming mode. For example, GitHub only allows letters, numbers, and underscores. Doppler rejects a secret name that a config's active syncs can't accept, and rejects a new sync if the config already contains names that the destination can't accept.
• Name transformers: With Permissive naming, you can often name secrets exactly as they should appear in the destination service, instead of relying on an integration's name transformer to convert them.

Environments View

Sets the default layout of the environments list within projects: List (the default) or Grid. Users can override this default for themselves.

Enterprise Key Management (EKM)

By default, Doppler encrypts your secrets with a workplace-specific encryption key. Enterprise Key Management (EKM) adds a second layer of encryption with a key stored in your own key management service, which you grant Doppler access to.

Use the Service dropdown to choose where your key is stored: Doppler KMS (the default), Amazon KMS, or Google KMS. Then, fill in the credentials for that service. See AWS EKM and GCP EKM for setup instructions.

When you switch services, Doppler migrates your secrets to the new key in the background. The section shows Migration: In Progress until the migration finishes, and you can click Cancel to stop it.

Configuring EKM requires the Manage EKM permission.

Email Settings

The Email Settings section controls which notification emails Doppler sends to workplace Owners. Both are turned on by default:

• New user joins team: Email workplace Owners when a new user joins the workplace.
• Workplace has a new Owner: Email workplace Owners when someone becomes an Owner.

Change either checkbox and click Save. This section is only shown to users with the Manage Settings permission.

Danger Zone

The Danger Zone section contains actions that affect every member of the workplace and can't be undone. Each action asks you to type the workplace name to confirm. This section is only shown to users with the Manage Settings permission.

Invalidate All Sessions

Immediately signs every member of the workplace out of the Doppler dashboard, including you. Every member will need to sign in again.

Revoke Access Tokens

Immediately revokes every access token of the types you select:

• Personal tokens
• CLI tokens

Any script, CLI, or integration that authenticates with a revoked token stops working until its owner creates a new token. Select at least one token type, type the workplace name, and click Revoke Access Tokens.

Delete Workplace

Permanently deletes the workplace and all of its data, and revokes access for all members, integrations, and services. You'll be asked to confirm, type the workplace name, and give a reason for deleting the workplace.

If this is the only workplace you belong to, you can also choose to delete your Doppler account at the same time by checking I also want to delete my account.