Comment on page


Solutions to common Secrets Manager issues

Access Denied

When attempting a Secrets Manager command in Commander, the tool responds with access_denied
In order to utilize Keeper Secrets Manager, two permission criteria must be met:
  1. 1.
    The Secrets Manager addon must be enabled for your Keeper Account
  2. 2.
    You must be in a role with the Secrets Manager enforcement policy enabled

Enabling the Secrets Manager Addon

Secrets Manager can be added from the "Secure Add Ons" section of the Keeper Admin Console.

Enabling the Secrets Manager Enforcement Policy

In the Keeper Admin Console add Secrets Manager to a role with role enforcements. Select or create a new role, open the "Enforcement Policies" settings and navigate to the "Keeper Secrets Manager" tab to allow or disallow Secrets Manager for the role.
The Keeper Secrets Manager Enforcement Policy in the Keeper Admin Console
Any users that are in a role with Secrets Manager allowed will be able to see the Secrets Manager tab in their Keeper Vault, and create and manage Secrets Manager Applications and Devices.
Enabling Secrets Manager with Keeper Commander
You must have Keeper account administrative permissions to create and edit roles.
To enable the Secrets Manager enforcement policy, use the following command in Keeper Commander:
er --enforcement="allow_secrets_manager:true" "<ROLE NAME>"
Replace <ROLE NAME> with the role you would like to set the enforcement policy to.
For example, to set the enforcement on the Keeper Administrator role:
er --enforcement="allow_secrets_manager:true" "Keeper Administrator"
For more information on creating and editing roles, and adding users to roles, see the Enterprise Management Commands documentation.

Record UID Starts With "-"

When performing commands with the KSM CLI that use a record or folder UID as an input, the command line interface cannot distinguish between a UID that starts with "-" and a command option. If the UID you are using begins with a "-" (dash / hyphen) simply add "--" before the UID to use it.
Example: ksm secret get -- -id8QpE2ZAkdd4KlCfoWQ
*The UID in this example is not a real record UID

Record not Found

When fetching secrets using Secrets Manager, the system responds that the record could not be found.
There are two reasons that this message may appear:
  1. 1.
    The record that is being searched for is not shared with the Secrets Manager Application
  2. 2.
    The record is a legacy (V2) non-typed record

Share Records with Secrets Manager

Individual records can be shared with a Secrets Manager Application, or a shared folder can be shared with a Secrets Manager Application, which will give access to all records in that folder.
To share records or shared folders with a Secrets Manager Application, in Commander use the following command:

Identify Typed Records

Keeper Secrets Manager supports typed records (V3) only. If a legacy, non-typed record is queried, Secrets Manager will respond that the record cannot be found.
To identify if a record is typed in Commander, use the get command
get <UID>
If the record has a type (and is compatible with Secrets Manager) it will be displayed in the record information
my vault> get pICzm4iw9sW454m2ZR4mmQ
UID: pICzm4iw9sW454m2ZR4mmQ
Type: login
Title: My Login
(login): john.doe
(password): N*3s.kk/Ji20}cJ7
Shared: False
Last Modified: 2021-10-18 16:08:04
Revision: 887800170
If the record is not typed (and not compatible with Secrets Manager) it will not have a Type field.
Additionally, you can view all records in the current folder using the ls -l command. The resulting table has a type column. Any records which are blank in the type column are non typed records.
My Vault> ls -l
# Folder UID Name Flags
--- ---------------------- ----------------- -------
1 RpdmergF5lpsaID3TcHu8A Devops Secrets S
2 461XtX26R1SggIyQDFGfZg Secrets S
3 ZDw67iL28d6-YqUVwBHAug Social
# Record UID Type Title Login URL
--- ---------------------- ------------------- ----------------------- --------------------- -------------------
1 FyP2it0DzwIDPSbch2WyHw address Bank Address 1
2 pICzm4iw9sWS_4m2ZR4mmQ login breached [email protected]
3 qUX4gSlmDRfM1Kq9lrQi-w databaseCredentials MySQL Database SQL_Admin
4 rlr04tiSxFmLmRNjEC7h7Q NonTyped Record legacy
In the above example, the bottom record (#4) is not typed, and not compatible with Secrets Manager

Create Typed Records

Typed records can be created in by clicking "Create New" in the vault, or using the add command in Commander.
When choosing a record type, all types are compatible with Secrets Manager except for the "General" type.
General type records are identical to legacy, non typed records.
Replace an existing record
If you have existing non typed records that you would like to use with Secrets Manager, we recommend creating a "Login" type record and copying the information to it.
Login type records have identical fields to legacy non typed Keeper records.
Login type records have the same fields as legacy Keeper records
Copy fields and files into the new typed record
Place the new typed record in a shared folder that your Secrets Manager application can access, or use the UID to share it to an application directly.

Convert Untyped Records

Untyped records can be converted to typed records that Secrets Manager can utilize by using the convert command in Keeper Commander.
convert <UID> --type <TYPE>
convert Dtvb84zwkBmZgxrUByUfpg --type login
The convert command can use patterns to find all relevant records, can recursively apply the conversion to all sub-folders, and supports all record types.
For more information on using the convert command, see the Commander documentation.


The Keeper Secrets Manager API throttles connections that make a large number of requests in a short period of time. If your connection is throttled, you will receive an error, such as a 503 response code (the actual message depends on the integration/SDK being used).

Details of the rate limits:

The Secrets Manager APIs are set to limit any system that makes more than 200 calls per 10 seconds.
This count resets when the 10 second timer expires, however it renews with each subsequent request sent in less than 10 seconds. So without a 10 second pause, the system will continue to be throttled.

Examples of when you may be throttled:

  • Making 201 calls in less than 10 seconds
  • Making 1 call per 9 seconds, you will be throttled on your 201'st call
API request limits are calculated by unique IP address