Overview
Secrets are encrypted credentials that bridges use at runtime. Archway encrypts all secret values with AES-256-GCM encryption — the same standard used by banks and governments.
Key Principles
SEs never see customer-provided values — When a customer provides a credential, the SE only sees that it has been provided, not the actual value
Scoped to customers — Each secret belongs to a specific customer for isolation
Referenced by name — Bridge code accesses secrets via environment variable names, never hardcoded values
Deployment blocking — Bridges cannot be deployed if any linked secrets are still pending
Secret Types
Single — A single value like an API key or token
OAuth — Client ID and Client Secret pair
Database — Host, port, username, password, database name, and optional SSL flag
Custom — User-defined fields for any credential structure
Who Provides the Secret?
When creating a secret, you choose who provides the value:
Customer Provides — The secret starts in "Pending" status. The customer provides values via the Customer Portal. The SE never sees the actual values.
SE Provides — You enter the values directly. The values are encrypted immediately and you can see a masked version later.