Doppler

Doppler

This connector uses the Doppler API v3 (https://api.doppler.com/v3) of Doppler, the secrets manager: workplace, members, groups and service accounts, projects and their members, environments, configs, secrets (names, values, updates, download), config change logs and rollback, the workplace activity log, integrations and service tokens.

Secrets are visible to the AI. doppler_list_secrets, doppler_get_secret and doppler_download_secrets return secret VALUES in clear text: they enter the conversation, the AI provider's context and the client's history. Masked and restricted visibility only hide values in the Doppler dashboard; the API returns them to any token with read access. Use doppler_list_secret_names to see what a config holds, read values only when the user asks for them, and never repeat a value back unless asked. Switch the three value-reading tools off if the AI should only see names and metadata.

Setup (2 minutes)

1. Pick a token at https://dashboard.doppler.com:
   • Service account token (dp.sa., Team and Enterprise plans): Team, Service Accounts, create one with a workplace role and project access limited to what the AI needs, then create an API token. Best choice.
   • Service token (dp.st.): in a project, open a config, Access, Generate. Choose read access unless the AI should write. It reaches only that one config: workplace, projects, activity log and integrations answer 403.
   • Personal token (dp.pt.): your account settings, Tokens. It can do everything you can, in every project.
2. Paste the token into DOPPLER_TOKEN. It is sent as Authorization: Bearer <token>.
3. Run doppler_get_me to check it; it shows the token type and workplace.

Workflow

• Who and where: doppler_get_me, doppler_get_workplace, doppler_list_workplace_users, doppler_list_groups, doppler_list_service_accounts.
• Structure: doppler_list_projects, doppler_get_project, doppler_list_project_members, doppler_list_environments, doppler_get_environment, doppler_list_configs, doppler_get_config.
• Secrets: doppler_list_secret_names first. Values only on request: doppler_get_secret for one, doppler_list_secrets for several (narrow it with secrets), doppler_download_secrets for a .env, JSON or YAML file.
• Changes: doppler_update_secrets creates or overwrites values, doppler_update_secret_note sets a note, doppler_create_project, doppler_update_project, doppler_create_environment, doppler_create_config and doppler_clone_config shape the structure. Confirm with the user before writing, above all to prd configs.
• History and audit: doppler_list_config_logs and doppler_get_config_log show what changed in a config; doppler_rollback_config_log restores the state before a change; doppler_list_activity_logs and doppler_get_activity_log are the workplace audit trail.
• Delivery: doppler_list_integrations, doppler_get_integration (syncs to AWS, GitHub, Vercel and others), doppler_list_service_tokens (metadata only, never token values).

Switched off at install: doppler_delete_secret; it cannot be undone, so an admin switches it on when the team needs it.

Identifiers: project is the project slug, environment the environment slug (dev, stg, prd), config the config name (a root config has the environment slug as name, a branch config starts with it, e.g. dev_feature_x). Secret names are case-sensitive, upper case by convention. Times are ISO 8601 in UTC.

Reading the answers: secret entries carry raw (as typed, with ${OTHER} references) and computed (references resolved). doppler_download_secrets with format: json returns a flat NAME to value object. Answers carry success: true; failures carry messages.

Paging: list tools take page (from 1) and per_page (default 20). Ask for the next page while a full page comes back.

Limits: per minute, Developer plan 240 reads, 120 secret reads and 60 writes; Team 480, 240 and 120; Enterprise 480, 480 and 240. Over the limit Doppler answers 429.

Errors: 401 means a wrong or revoked token, 403 a token without access to that project, config or workplace endpoint (a service token reaches only its config), 404 an unknown project, config, secret or log id, 400 an invalid name or body, 429 the rate limit.