Doppler

Import secrets from a Doppler config. One way only: penv never writes back.

The connection

What	This provider
Vendor	Doppler
Key	`doppler-secrets`
Availability	`available`. You can connect it today.
Credential penv holds	`doppler-token`
Values read back	yes
Activation	`immediate`

Direction	What it does
`import`	Reads names and values out of the store into penv.

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`

How syncs work says what each one does.

You paste a credential you already hold. penv seals it and never shows it again.

Field	Label	Kind	Required	What it is
`token`	Service token	secret, masked here and sealed	yes	Use a service token. Doppler returns a restricted secret's value to a service token and withholds it from a token tied to a person.

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`project`	Project	text	yes	no	The Doppler project to read from.
`config`	Config	text	yes	no	Which of its configs. A service token is issued for exactly one.

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`token:read`	every direction	yes	We cannot confirm which Doppler workplace this token belongs to.
`secrets:read`	`import`	yes	Import cannot read any values.