What is an Auth Secret?
An Auth Secret is the private half of a Workspace-scoped Auth Key and Auth Secret pair, comparable to a password for secure automation. It must remain confidential and can be regenerated if compromised, and a Workspace can hold several active key pairs.
How Auth Secrets work
The Auth Secret is the private input used by trusted code to produce request signatures for its Workspace. The service can verify those signatures without the credential being transmitted as ordinary request data. It therefore belongs in a server-side secret store, distinct from the public Auth Key it pairs with and from short-lived signed parameters delivered to a client. Webhook secret selection differs between an initial Notification, including one from an Assembly replay, and a Notification replay, which can use a historical key or fall back to the replay caller’s secret. Follow the webhook verification contract, selecting applicable secrets from trusted server-side configuration for the expected Workspace and Assembly, never from unverified payload fields. Rotation must be coordinated across signers and webhook consumers.
Key facts
- Embedding the secret in browser JavaScript or a mobile binary makes it extractable; client uploads should receive server-generated signed request material instead.
- Regenerating a secret in place invalidates signatures created with the previous value. For a planned rotation, add another key pair and migrate signers. Before retiring the old pair, account for outstanding signed requests and URLs and update webhook consumers for initial and replayed Notifications that may still require its secret. Where required, identify the pair with its
auth_key, including in signed Smart CDN URLs. - Logs, error reports, and observability payloads need redaction because accidental diagnostic capture can compromise the credential even when source code is clean.
When Auth Secrets matter
Keep the Auth Secret on trusted servers and use it to sign requests without exposing it to browsers or mobile clients. For webhook verification, select the applicable secret from trusted server-side configuration using the webhook verification contract. If a secret leaks, rotate it promptly and update every dependent integration.