The problem a named entry cannot solve
A named registry entry is one secret with one value: auth-session-secret, media-storage-credentials.
Some secrets do not work that way. One signing key per customer connection. One credential per tenant. The names only exist at runtime, and the registry can no more list them than it can list next month’s customers.
A keyed entry declares a keyspace
Only the d1 backend supports one — the two backends differ here. Using Secrets has the calls, the reference the config.
One schema, one backend, and an unbounded set of members.
A member is stored under <entry>/<key> — in the same encrypted store as everything else, sealed under the same master key, so at-rest rotation, the audit and teardown all keep working with no second storage path to maintain.
/ is the one separator, and it is illegal in an entry name
That single rule does two jobs:
A keyspace member can never collide with a declared secret, because no declared secret’s name can contain the separator.
No key can compose its way into a neighboring keyspace, because there is exactly one place the separator can appear.
Every key is validated before it is composed
^[A-Za-z0-9][A-Za-z0-9._-]*$Letters, digits, dot, dash and underscore. Starting with a letter or digit. At most 128 characters.
The separator, whitespace, and control characters are all excluded. So ../OTHER/victim is refused at the call rather than resolved at the store — which is the whole security argument, and the reason there is exactly one sanctioned way to compose a member name. Read and write both go through it, so there is a single place where a key is proven legal.
One tenant’s credential is not reachable with another tenant’s key. Not by convention, and not by a check somewhere upstream.
The name is bound as authenticated data too
For a keyspace member the bound name is the whole <entry>/<key>. So the master key’s guarantee reaches down to the member: a ciphertext moved from one tenant’s row to another’s does not open, inside the primitive.
Parsing back
A stored name splits into its keyspace and its key, and the audit uses that to attribute a stored member to the keyspace that declared it.
Which is what stops a tenant’s credential being reported as an orphan. Without the parse, every member of every keyspace would look like a stored secret nothing declared — and an audit that cries wolf on every tenant is an audit nobody reads.
The parse is validating, not merely splitting: a stored name whose key half would not pass validation is not treated as a member.