---
title: "Fortanix DSM with GitHub"
slug: "fortanix-dsm-with-github"
updated: 2026-08-19T14:28:30Z
published: 2026-08-19T14:28:30Z
canonical: "support.fortanix.com/fortanix-dsm-with-github"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with GitHub

## 1.0 Introduction

This article explains how to integrate **Fortanix-Data-Security-Manager (DSM)** with **GitHub Actions** to securely retrieve secrets during a build pipeline.

It also explains how to:

- Authenticate **GitHub Actions workflows** with Fortanix DSM.
- Retrieve secrets securely during pipeline execution.
- Use those secrets in build steps. For example, **code signing**.

## 2.0 Prerequisites

Ensure the following:

- Access to a Fortanix DSM account with appropriate administrative privileges.
- Knowledge of how to create and manage security objects (secrets) in Fortanix DSM, including generating or importing secrets.
- A GitHub repository with permission to manage:
  - Repository Secrets
  - Repository Variables
  - GitHub Actions workflows
- Basic understanding of GitHub Actions workflows and YAML configuration

## 3.0 Configure Fortanix DSM

This section describes the steps to configure Fortanix DSM to generate and import a security object.

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![A screenshot of a login screen  AI-generated content may be incorrect.](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-github-image-lahks421.png)

**Figure 1: Logging In**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*User's Guide: Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui#30-setting-up-an-account)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-github-image-mt7k1xpx.png)

**Figure 3: Add Application**
2. On the **Adding new app** page:
  1. **App name:** Enter the name for your application.
  2. **ADD DESCRIPTION** (optional)**:** Enter a short description of the application.
  3. **Authentication method:** Select **API Key** or **Certificate** as the authentication method, depending on your security and automation requirements, from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/hc/en-us/articles/360033272171-User-s-Guide-Authentication)*.*
  4. **Assigning the new app to groups:** Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-github#33-creating-a-group) from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-github#34-creating-an-application) to go to the detailed view of the app
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it later.

### 3.6 Creating a Security Object

Perform the following steps to generate a **Secret** security object in Fortanix DSM:

1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-github-image-x2bp6y1a.png)

**Figure 4: Add Security Object**

1. On the **Add new Security Object** page:
  1. **Security Object name**: Enter the name of your security object. For example, **Github_secret**.
  2. **Group**: Select the group as created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-github#33-creating-a-group).
  3. Select **IMPORT**.
  4. In the **Choose a type** section, select the **Secret** key type.
  5. In the **Place value here or import from file** section, select the value format type as **Hex**, **Base64,** or **Raw**, and click **UPLOAD A FILE** to upload the key file.
  6. In the Key operations permitted section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.

> [!NOTE]
> NOTE
> 
> Ensure that the **Export** permission is selected.
  7. Click **IMPORT** to generate the security object.
2. Open the newly created Security Object and copy the **Security Object ID**. This ID is the `KID` and will be used in the GitHub Actions workflow to retrieve the secret value.

*For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.*

## 4.0 Integration Steps

Perform the following steps:

1. Navigate to GitHub and select the repository where you want to set up the integration.
2. Navigate to **Settings → Secrets and variables → Actions → Secrets**.
3. Click **New repository secret** and add the required secrets based on your authentication method:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-github-image-rzt9o5pg.png)

**Figure 5: Add repository secrets**
  - **API Key-based Authentication**:
    - `API_KEY`: The Fortanix DSM Application API Key obtained in [*Section 3.5: Copying the API Key*](/v1/docs/using-fortanix-data-security-manager-with-github#35-copying-the-api-key)*,* used for **API Key-based** **authentication***.*
  - **Certificate-based Authentication:**
    - `DSM_CERT`: The Base64-encoded client certificate (public certificate) used for **Certificate-based** **authentication** with Fortanix DSM. This certificate must correspond to the DSM Application configured for certificate authentication.
    - `DSM_KEY`: The Base64-encoded private key associated with the client certificate (`DSM_CERT`). This private key is used during mutual TLS (mTLS) authentication when GitHub Actions connects to Fortanix DSM.
4. Navigate to **Settings → Secrets and variables → Actions → Variables.**
5. Click **New repository variable** to add the following variables:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-github-image-v9m24rat.png)

**Figure 6: Add variables**
  - `DSM_FQDN`: The Fortanix DSM endpoint. For example, **eu.smartkey.io**.
  - `KID`: Fortanix DSM Secret Key ID obtained in [*Section 3.6: Creating a Security object*](/v1/docs/using-fortanix-data-security-manager-with-github#36-creating-a-security-object) when the secret is imported into Fortanix DSM.
6. Create a new workflow file (for example, `fetch-secret.yml`) in your repository at the path: `.github/workflows/fetch-secret.yml`.
7. Edit the `fetch-secret.yml` file as follows to configure the integration as a **manually triggered workflow** using `workflow_dispatch`.

> [!NOTE]
> NOTE
> 
> If you want to run the workflow **automatically**, you must replace the `workflow_dispatch` under the `on:` section with the appropriate trigger. For example, `push`, `pull_request`, or `schedule`.
> 
> *For detailed steps on how to configure the trigger, refer to the* [*GitHub official documentation*](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow)*.*
  - **API Key-based Authentication**

```yaml
name: Fetch Secret from DSM
on: 
  workflow_dispatch:
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Fetch Secret from DSM
        id: kms
        run: |
          RESPONSE=$(curl -s -X POST https://${{ vars.DSM_FQDN }}/crypto/v1/keys/export \
            -H "Authorization: Basic ${{ secrets.API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"kid":"${{ vars.KID }}"}')
          SECRET=$(echo "$RESPONSE" | jq -r '.value')
          if [ -z "$SECRET" ] || [ "$SECRET" = "null" ]; then
            echo "KMS did not return a secret value"
            exit 1
          fi
          DECODED=$(echo "$SECRET" | base64 -d)
          echo "::add-mask::$SECRET"
          echo "MY_SECRET=$DECODED" >> $GITHUB_ENV
      - name: Use Secret
        run: echo "Secret retrieved successfully"
```
  - **Certificate-based Authentication**

```yaml
name: Fetch Secret from DSM
on: 
  workflow_dispatch:
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Get certificates
        run: |
          set -euo pipefail
          echo "${{ secrets.DSM_CERT }}" | base64 -d > client.crt
          echo "${{ secrets.DSM_KEY }}" | base64 -d > client.key
          chmod 600 client.key         

      - name: Fetch Secret from DSM
        id: kms
        run: |
          RESPONSE=$(curl -s -X POST https://${{ vars.DSM_FQDN }}/crypto/v1/keys/export \
            --cert client.crt \
            --key client.key \
            -H "Content-Type: application/json" \
            -d '{"kid":"${{ vars.KID }}"}')
          SECRET=$(echo "$RESPONSE" | jq -r '.value')
          if [ -z "$SECRET" ] || [ "$SECRET" = "null" ]; then
            echo "KMS did not return a secret value"
            exit 1
          fi
          DECODED=$(echo "$SECRET" | base64 -d)
          echo "::add-mask::$SECRET"
          echo "MY_SECRET=$DECODED" >> $GITHUB_ENV
      - name: Use Secret
        run: echo "Secret retrieved successfully"
```
8. After editing the file, run the workflow.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-github-image-w1g85cpx.png)

**Figure 7: Run the workflow**
9. Verify that the workflow completes successfully by navigating to the **Actions** tab in your GitHub repository and confirming that the job (For example, **Fetch Secret from External KMS)** runs without errors and retrieves the secret successfully.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-github-image-n2j9c3i0.png)

**Figure 8: Verify the integration**

## 5.0 Appendix

### 5.1 Optional: Generate and Import a Secret Using the DSM Plugin

This section describes how to use a Fortanix DSM plugin to generate a random secret and optionally import it as a **SECRET** security object.

> [!NOTE]
> NOTE
> 
> The GitHub Actions workflow does not invoke this plugin. This plugin is only used to generate and optionally store a secret in Fortanix DSM before integration.

Perform the following steps to generate a plugin in Fortanix DSM to generate and store a secret in Fortanix DSM:

1. Add the following plugin code while generating a new plugin in Fortanix DSM:

*For more information, refer to the* [*User’s Guide: Plugin Library*](https://support.fortanix.com/hc/en-us/articles/360041950371-User-s-Guide-Plugin-Library)*.*

```bash
numericAlphabet = "0123456789"
alphanumericAlphabet = numericAlphabet .. "abcdefghijklmnopqrstuvwxyz"
alphanumericCapsAlphabet = alphanumericAlphabet .. "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
alphanumericCapsSymbolsAlphabets = alphanumericCapsAlphabet .. "!@#$&*_%="

function genPass(alphabet, len, name, import)
local alphabetSize = #alphabet
local password = ''

for i = 1, len, 1 do
local random_char = math.random(alphabetSize)
password = password .. string.sub(alphabet, random_char, random_char)
end

local pass = Blob.from_bytes(password)

if import == "yes" then
local sobject = assert(Sobject.import {
name = name,
obj_type = "SECRET",
value = pass,
key_ops = {'APPMANAGEABLE', 'EXPORT'}
})

-- Return both password and KID
return {
password = password,
kid = sobject.id
}
end

-- If not importing, return only generated password
return {
password = password
}
end

function run(input)
if input.type == "numeric" then
return genPass(numericAlphabet, input.length, input.name, input.import)
end

if input.type == "alphanumeric" then
return genPass(alphanumericAlphabet, input.length, input.name, input.import)
end 

if input.type == "alphanumeric_caps" then
return genPass(alphanumericCapsAlphabet, input.length, input.name, input.import)
end 

if input.type == "alphanumeric_caps_symbols" then
return genPass(alphanumericCapsSymbolsAlphabets, input.length, input.name, input.import)
end
end
```

- Set the import option to **yes** if you want to store the secret in Fortanix DSM.

```bash
{
    "type": "numeric",
    "length": 64,
    "name": "GitHub-Secret",
    "import": "yes"
}
```

**Output:**

```bash
{
"password": " 839274938274...",
"kid": "b3f1c2a4-xxxx-xxxx-xxxx-xxxxxxxx"
}
```

- Set the import option to **no** if you only want a new value generated for rotation.

```bash
{
    "type": "numeric",
    "length": 64,
    "name": "GitHub-Secret",
    "import": "no"
}
```

**Output:**

```bash
{
"password": " 839274938274..."
}
```

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.