Agentic Fabriq
Doppler
DEVELOPER · DEVELOPER
Projects, configs, and secrets reached with that person’s own token.
Connecting Doppler in practice
Reading secrets is metered separately from everything else — 120 secret reads a minute on the Developer plan against 240 general reads and 60 writes — so an agent that fetches a secret on every invocation hits a wall long before its other calls do. Doppler also ships six distinct token types, each with a different blast radius.
Scopes that draw scrutiny
Personal tokenDoppler defines access by token type rather than scope string. A personal token carries complete account permissions from the dashboard, so it is the widest credential a member can create.CLI tokenFull account access via the command line, which is what a developer machine holds and the least appropriate thing to copy into an agent.Service tokenLimited to read or read/write access on one specific config, so it is the narrowest option — and correspondingly needs one credential per config.Service account tokenGranular permissions across workplace resources, so it spans projects rather than a single config.SCIM tokenManages users and groups, which is identity administration for the whole workplace.Audit tokenRead-only access to audit data for the whole workplace, so it exposes who did what across every project.
Rate limits
- Per minute, by plan — Developer: 240 general reads, 120 secret reads, 60 writes.
- Team: 480 general reads, 240 secret reads, 120 writes.
- Enterprise: 480 general reads, 480 secret reads, 240 writes.
- Headers: x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset (a Unix timestamp) and retry-after on a 429.
Worth knowing
- Secret reads have their own budget, half the general-read allowance on the Developer plan, so the call an agent makes most often is the one with the tightest limit.
- Service account identity tokens are "short lived tokens...attached to a Service Account Identity", so they need refreshing, unlike the long-lived service token they replace.
- A service token is scoped to a single config, so an agent working across dev, staging and production needs three credentials rather than one project-level grant.
- x-ratelimit-reset is a Unix timestamp rather than a seconds-until-reset delta, so treating it as a sleep duration waits until 2038.
Checked against Doppler API reference (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Doppler behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.