Skip to main content
Modulo

Secrets

Pipelines need credentials to call external services, and those credentials must not leak into places that outlive a run. This page covers the keys that encrypt them, the rules that keep them out of logs, state, and API responses, and the frontend rule for displaying them.

Encryption keys

  • Fernet symmetric encryption is keyed from the FERNET_KEY environment variable
  • FERNET_KEY is separate from SECRET_KEY, which is used exclusively for signing JSON Web Tokens (JWTs). The keys have distinct cryptographic purposes.
  • Key rotation for connector credentials must not require JWT session invalidation, and vice versa
  • The backend refuses to start if either key is absent or malformed: SECRET_KEY must be at least 32 bytes, and FERNET_KEY must be a valid Fernet key (32 url-safe base64-encoded bytes)

Never logged or returned

Secrets are never logged and never returned in API responses.

Credential-in-state rule

Decrypted connector credentials and model backend API keys must never enter LangGraph state, checkpoint blobs, OpenTelemetry span attributes, or log output. Connectors receive the decrypted credential in-process only (via a transient context object), use it for the API call, and do not serialize it.

At-rest encryption

Connector credentials are stored encrypted with Fernet symmetric encryption, keyed by FERNET_KEY, and decrypted only in-process at run start (see the credential-in-state rule above).

Sensitive values in the DOM

Sensitive field values (API key secrets, connector credentials, webhook secrets, model backend API keys) must never exist in the Document Object Model (DOM) in plaintext unless the user has explicitly completed a server-authenticated reveal action.

  • Sensitive values render as ●●●●●●● in the DOM by default
  • A reveal action calls the server; the server verifies authentication and returns the value in the API response body
  • The frontend injects it into the DOM for a time-limited display window (default 30 seconds)
Next: Single Sign-On (SSO)