Skip to main content

Designer Demo Tenant

TL;DR

Create a demo tenant and demo bundles with placeholder or test keys so designers can run the app without access to production credentials.

Why this matters

  • Protects production credentials from accidental use by non-engineers.
  • Gives designers a safe environment to test and iterate quickly.
  • Enables short-lived demo access with expirations.

Steps

  1. Create a demo bundle with placeholder keys:
# demo bundle manifest (example)
name: my-project/demo
description: Demo bundle for designers
secrets:
  - key: DATABASE_URL
    type: placeholder
    note: use a local sqlite:// or stub value
  - key: STRIPE_KEY
    type: placeholder
    note: use test keys
policies:
  access: [role:Designer]
  expires_in: 7d

  1. Create the bundle via UI or API and attach placeholder keys.

  2. Invite designer and assign Designer role:

envcat user invite designer@example.com --role Designer --tenant my-project
  1. Designer fetches demo bundle and approves device:
eval "$(envcat get --bundle my-project/demo --api-base http://localhost:8888)"

Best practices

  • Use non-production keys (test modes) for all demo bundles.
  • Set expirations (7 days or less) and re-issue when needed.
  • Audit demo access periodically and remove stale accounts.

Troubleshooting

If the demo bundle shows masked values in the UI, ask an Admin to reveal values (dev mode only) or to regenerate placeholder values.

Next steps

  • Onboard a new developer: ../recipes/onboard-new-dev.md