Document scalable secret management with external vaults

[thebiglabasky]

Summary

• add a canonical guide for loading external secrets at deploy time and scoping them to Checkly groups and checks
• add researched GitHub Actions recipes for AWS Secrets Manager, Google Secret Manager, Azure Key Vault, and HashiCorp Vault
• clarify deployment ownership, rotation, least privilege, and the difference between deploy-time injection and runtime secret retrieval
• correct construct examples to use secret() instead of presenting {{...}} as a deployment-time secret source

Why

Large account-level secret sets are sent to every check execution and do not scale sustainably. These guides document the supported architecture: use an external manager as the value source, authenticate CI with short-lived OIDC credentials, and deploy each secret at the narrowest Checkly scope.

Validation

• Mintlify broken-links scan
• frontmatter and canonical integrity checks
• legacy redirect destination checks
• docs.json parsing and regenerated sitemap
• embedded TypeScript, YAML, Bash, and JSON examples
• git diff --check

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
checkly-422f444a	🟢 Ready	View Preview	Jul 30, 2026, 1:41 PM