1. Latest Release Home
  2. Guides
  3. Concepts
  4. Tools
  5. References
  6. Integrations
  7. Data Apps (Blueprints)
  8. Data Governance
  9. Incorta Applications
    1. Build applications via the Builder Agent
    2. Publish an application
    3. Manage application databases
    4. Manage application secrets
    5. Manage application versions
    6. AppKit CLI
  10. Release Notes
  11. Incorta Premium
  12. Release Support Policy
  13. Release Model

Guides → Manage Application Secrets

Context

This content applies to Incorta Cloud deployments only.

Secrets are the credentials that your application needs at runtime, such as API keys, tokens, and credentials for third-party services. Incorta stores secrets encrypted and injects them into the application as environment variables.

Secret values are write-only. After you save a secret, its value is never shown again in the UI, the API, or the AppKit CLI. You can replace a secret, but you cannot read its value back.

Note

You can use the Use the appkit secrets commands in the AppKit CLI to list, set, import, and remove secrets in both development and production sets. For details, refer to References → AppKit CLI?.

Development and production secrets

Each application has two separate sets of secrets:

SetUsed byManaged in the UI
DevelopmentThe dev server and previewsMore > Secrets
ProductionThe published applicationMore > Production > Production secrets

Manage development secrets

Add development secrets

  1. In the Application Editor, select More.
  2. In the navigation panel, select Secrets.
  3. On the Secrets page, select Add secret.
  4. In the Add secret dialog, enter the following:
    • Name: The name of the environment variable, for example, API_KEY.
    • Value: The secret value. To show the value while you enter it, select the eye icon.
  5. To add more secrets, select Add another, and then enter the name and value of each secret. To remove a row, select the delete icon.
  6. Select Save.

Both the name and the value are required for each secret.

View development secrets

  1. In the Application Editor, select More.
  2. In the navigation panel, select Secrets.

The Secrets page lists development secrets, including each secret's name and last updated date. To find a secret, enter its name in the search box.

Edit or delete a development secret

On the Secrets page, use the icons in the row of the secret:

IconAction
CopyCopies the secret name
EditReplaces the secret value
DeleteDeletes the secret
Important

Because secret values are write-only, editing a secret replaces its value. You cannot view the current value.

Manage production secrets

Production secrets are the published application's own set, separate from the development secrets. Publishing never overwrites production secrets.

Important

The published application uses only its production secrets, never the development secrets. The first time you publish, Incorta copies your development secrets to production. After that, the two sets are managed separately and do not sync. If you add or change a development secret after the first publish, the published application does not receive the change until you also update the production secret.

To view the production secrets:

  1. In the Application Editor, select More.
  2. Do one of the following:
    • In the navigation panel, select Production, and then scroll to the Production secrets section.
    • Select Secrets, and then select Production secrets.

The Production secrets section lists the production secrets with the following details:

ColumnDescription
SecretThe name of the secret. A Managed label marks secrets that Incorta supplies, such as DATABASE_URL.
In production sinceThe date the secret was added to production
StatusThe status of the secret. Managed secrets show Injected by the platform.

You cannot edit or delete managed secrets.

Add a production secret

  1. In the Production secrets section, select Add secret.
  2. Enter the name and value of the secret.
  3. Select Save.

Copy development secrets to production

If a development secret does not exist in production, the Production secrets section lists its name next to Set in development but not here.

To copy the missing secrets to production, select Add to production, then select Apply to production to save the changes.

Note

Changing production secrets restarts the published application.

Reserved names

Secret names that begin with INCORTA_ and DATABASE_URL are reserved. Incorta uses these names to supply the application's Incorta credentials. Reserved secrets do not appear on the Secrets page, and you cannot set them.

What not to store as a secret

  • Values that the application does not need at runtime
  • Values that you need to read back later, because you cannot view a secret value after you save it

Secrets and the security check

When you publish, Incorta scans the application files and the built output for secret values. If the scan finds one of your secret values in the code, the publish is blocked. To fix the issue, remove the value from the code and read it from the environment variable instead.