Glossary
app key
A token prefixed with orb_live_ used by your running application to authenticate with Orbseal. Scoped to a single project (and optionally one environment). Carries a registered public key so Orbseal knows which ciphertext to serve for secrets. Created via orbseal keys create.
admin token
A token prefixed with orb_admin_ used for management operations: creating workspaces, setting values, syncing schema, cutting releases. Never used in production app code.
definition
A schema entry declared in orb.yaml. Defines a key's type, scope, default value, and constraints. Definitions must exist before values can be set for them.
environment
The most specific named context within a project: production, staging, preview, etc. Environment-scoped values and secrets are isolated from each other. Maps to a slug and short_id.
etag
A short fingerprint (first 8 hex bytes of SHA-256) of a release's config content and version number. Used for cache validation — if the etag hasn't changed, the config hasn't changed and your app can skip re-fetching.
etag: 9e691b38a0b25e68
MCP (Model Context Protocol)
An open protocol for giving AI agents structured access to external tools and data sources. The Orbseal MCP server exposes resolve, get_user_settings, and set_user_preference as tools, so an AI agent can securely read and update config on behalf of a user without handling credentials directly.
orb.yaml
The schema definition file at the root of your application repository. Declares all configuration keys, their types, scopes, defaults, and UI hints. Synced to Orbseal with orbseal sync.
organization
The top-level entity in Orbseal. Corresponds to a company or team. Contains workspaces. Has one or more members with roles (admin, member, viewer).
plugin
The namespace prefix for a set of related definitions, matching the plugin: field in orb.yaml. Separates config keys from different apps or modules within the same project (e.g. taskflow:max_seats, billing:trial_days).
project
A named application within a workspace. Contains environments, schema definitions, values, and app keys. Maps to a slug (e.g. taskflow) and a short_id (e.g. zdfmcs).
public key / private key
An X25519 keypair generated by orbseal keygen. The public key (orbpk-...) is registered with Orbseal when creating an app key. The private key (orbsk-...) stays on your infrastructure and is used at runtime to decrypt secrets. Orbseal never receives the private key.
recovery phrase
A 12-word BIP-39 mnemonic that can deterministically regenerate a keypair. Write it down and store it offline. Used with orbseal recover if the private key is lost.
release
A numbered, immutable snapshot of all resolved non-secret config values for a specific environment at a point in time. Identified by a version number and etag. Secrets are not included — they are resolved live.
resolution
The process of computing the effective value for every config key for a given context (project + environment + optional user). Values are resolved scope-by-scope from most specific (user) to most general (workspace), returning the first match. Falls back to the definition's default.
scope
The level at which a config value is set. From broadest to most specific: workspace → project → environment → user. A definition's scope is the narrowest level at which its value can be set.
scope_ref
The ID of the specific entity the value is attached to (e.g. the UUID of a particular environment). When setting values via CLI you pass slugs; Orbseal resolves them to IDs internally.
sealed-box
The libsodium primitive (crypto_box_seal) used to encrypt secrets. Encrypts data to a recipient's public key using ephemeral X25519 + XSalsa20-Poly1305. Only the holder of the matching private key can decrypt.
short_id
A 6-character immutable identifier generated at creation time (e.g. xzvdrg). Uses a consonant-heavy alphabet (bcdfghjkmnpqrstvwxyz2345678) to avoid accidental words. Stable across renames — use this in infrastructure references (k8s namespace, CI vars).
slug
A human-readable, URL-safe identifier for a workspace, project, or environment (e.g. platform, taskflow, production). Auto-generated from the display name. Unique within its parent. Mutable — can be renamed. Use in URLs, API paths, and CLI commands.
workspace
A named tenant or deployment context within an organization (e.g. platform, eu-region). Contains projects. Maps to a slug and short_id.