# SecretSpec 0.19: Moving and importing secrets between providers

DevFeed: [SecretSpec 0.19: Moving and importing secrets between providers](<https://devfeed.tech/articles/secretspec-0-19-moving-and-importing-secrets-between-providers-31365.md>)

Original publisher: [Read original article](<https://discourse.nixos.org/t/secretspec-0-19-moving-and-importing-secrets-between-providers/79536>)

Author: domenkozar

Published: 2026-08-11T23:15:09Z

Content type: release

Language: en

Sources: [Announcements - NixOS Discourse](<https://devfeed.tech/sources/announcements-nixos-discourse.md>)

Topics: [configuration](<https://devfeed.tech/topics/configuration.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>), [servers](<https://devfeed.tech/topics/servers.md>)

Tags: [announcements](<https://devfeed.tech/tags/announcements.md>), [config](<https://devfeed.tech/tags/config.md>), [generate](<https://devfeed.tech/tags/generate.md>), [json](<https://devfeed.tech/tags/json.md>), [moving](<https://devfeed.tech/tags/moving.md>), [providers](<https://devfeed.tech/tags/providers.md>), [release](<https://devfeed.tech/tags/release.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [self-hosted](<https://devfeed.tech/tags/self-hosted.md>), [servers](<https://devfeed.tech/tags/servers.md>), [verify](<https://devfeed.tech/tags/verify.md>)

## AI overview

SecretSpec 0.19 introduces provider-specific secret storage layouts, safer imports with verification before deletion, value transformations, configuration stored alongside secrets, ephemeral values and runtime prompts, Passbolt support, and faster remote-provider operations.

## Source excerpt

Hey all, secretspec 0.19 is out with highlights: Provider-specific storage layouts: map one application variable to each provider's native item, field, vault, or path. Safer imports: preflight every source and destination, verify copied values, and only then delete the source. Value transforms: decode Base64 or hexadecimal values and extract fields from JSON documents. Config in secrets: resolve committed, profile-specific configuration alongside provider-backed secrets. Ephemeral values and runtime prompts: generate or securely request values that should exist for only one invocation. Passbolt support: read and write secrets in self-hosted Passbolt servers. Faster remote providers: attach local caches directly to authoritative providers and batch 1Password field reads. Read the full release post: SecretSpec 0.19: Moving and importing secrets between providers | SecretSpec Disclaimer: LLMs have been used 1 post - 1 participant Read full topic