What is an Auth Secret?
An Auth Secret is a private credential for a Transloadit account, comparable to a password for secure automation. It must remain confidential and can be regenerated if compromised.
How Auth Secrets work
The Auth Secret is the private input used by trusted code to produce request signatures for a Transloadit account. The service can verify those signatures without the credential being transmitted as ordinary request data. It therefore belongs in a server-side secret store, distinct from the public Auth Key and from short-lived signed parameters delivered to a client. Rotation is an operational event that must be coordinated across every signer.
A client authenticates and submits files or references together with workflow instructions. The platform validates the request, schedules dependent operations, records state transitions, and exposes results through a response, polling endpoint, or notification.
Platform concepts become reliable only when their lifecycle is explicit. Authentication, idempotency, retries, timeouts, observability, quotas, and terminal states should be designed together rather than added after failures occur.
Key facts
- 1Embedding the secret in browser JavaScript or a mobile binary makes it extractable; client uploads should receive server-generated signed request material instead.
- 2Regeneration invalidates signatures created with the previous value, so deployments and queued work must be coordinated to avoid an authentication outage during rotation.
- 3Logs, error reports, and observability payloads need redaction because accidental diagnostic capture can compromise the credential even when source code is clean.
When Auth Secrets matter
Keep the Auth Secret on trusted servers and use it to sign requests without exposing it to browsers or mobile clients. If it leaks, rotate it promptly and update every dependent integration.
- Running repeatable upload, import, processing, AI, storage, and notification pipelines.
- Tracking long-running media work independently from an application request.
- Applying credentials, quotas, retries, and error policies consistently across integrations.
Working with platform at scale
Guidance that holds across every platform term in this glossary, not just Auth Secrets.
What you gain
- Reusable workflows separate application intent from processing infrastructure.
- Stable job identifiers and lifecycle events improve observability and recovery.
- Managed queues and workers let products scale without embedding every media tool.
What it costs
- Synchronous responses are simple but keep connections open while long work executes.
- Aggressive retries improve recovery from transient faults but can duplicate work or overload a dependency.
- Higher concurrency reduces queue time until resource contention or a downstream limit becomes the bottleneck.
Answer these before production
- 1Define authentication, authorization, idempotency, retries, and terminal error behavior.
- 2Observe queue time, execution time, callbacks, and partial results with stable identifiers.
- 3Exercise malformed, duplicate, interrupted, and unauthorized requests before launch.
How Transloadit helps with Auth Secrets
When Auth Secrets are relevant to your workflow, you can hand the surrounding platform work to Transloadit instead of maintaining the processing stack yourself. Transloadit models file workflows as reusable Assembly Instructions. Upload, import, processing, AI, storage, delivery, status updates, and error handling can be composed without operating the underlying media tools yourself.
Support for a specific codec, container, parameter, or combination can vary by Robot and processing stack. Check the linked documentation for the exact inputs and outputs available for your use case.