Secrets Preview

A secret is a named credential a script reads by calling GetSecret("name"). It is the place to keep an API token, a database password or a webhook URL so it does not have to sit in the script itself, where every administrator can read it and every database backup carries it.

This page is the console. The language has its own book

How a script reads a secret, and the full discussion of what the store does and does not protect you from, is on The secret store.

Creating one

Automation, then Secrets, then Add secret.

Field	Notes
Name	What the script passes to GetSecret(). Capitals do not matter
What it is for	A note for whoever reads this list later. Scripts never see it
Value	The credential itself, up to 64 KB

Saving applies to the next script run. No restart.

Two secrets cannot have names differing only in capitalisation, because GetSecret would then have no way to tell you which one it returned.

The value is write only

You will not be able to read it back

The value travels one way. Once saved it is never displayed, never returned to your browser, and there is no reveal button anywhere. Keep your own copy wherever you normally keep credentials.

That is why the value box is empty every time you open a secret for editing, including one that already has a value. Leaving it empty keeps what is stored, so you can rename a secret or correct its note without knowing the value. Typing something replaces it.

Deleting

Deleting is never refused, but the Used by column names the scripts whose source mentions the secret, so you can see what will break.

That list is a hint, not a guarantee. A script can assemble a name while it runs, and nothing here can see that. After a delete, any script reading the name gets an empty string, silently, so check Activity after removing one that was in use.

Who can read them

Write only applies to this page, not to scripting

Any administrator who can create a script can read every secret on this Connector, by writing a script that logs one. There is no permission separating the two.

This store keeps credentials out of script source, out of script exports and out of readable backups. It is not a barrier between your own administrators and your credentials. For that, the control is who can reach this console.

Backing them up

Values are encrypted with a key file in the Connector's data directory. It never leaves the machine, and neither SFTP.cloud nor Syncplify holds a copy.

Back up the data directory, not just the database

Restore the database onto another machine without that key file and every secret becomes permanently unreadable, exactly as with your encryption keys.