> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.crewai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets Configuration

> Configuration for sensitive secret values used by the CrewAI Platform.

Direct secret values (used when `externalSecret.enabled: false`).

<Note>
  Never commit actual secret values to version control. Use secure secret management practices:

  * Store in separate, gitignored values file
  * Use Helm `--set` flags from CI/CD secrets
  * Use encrypted secret management (SOPS, sealed-secrets, etc.)
  * Prefer external secret stores for production
</Note>

## Automatic Pod Restarts

When you update secret values in your Helm values file and run `helm upgrade`, all affected pods (web, worker, OAuth, registry, MinIO) automatically restart to pick up the new credentials. This ensures your deployment always uses the latest secret values without requiring manual intervention.

**What triggers automatic restarts:**

* Changes to any value in the `secrets` section
* Changes to OAuth provider credentials in `oauth.secrets`
* Changes to Replicated license fields (if using Replicated distribution)

**Example workflow:**

```bash theme={null}
# 1. Update secrets in your values file
vim my-values.yaml  # Change DB_PASSWORD or other secrets

# 2. Apply the changes
helm upgrade crewai-platform oci://registry.crewai.com/crewai/stable/crewai-platform \
  --values my-values.yaml

# 3. Pods automatically restart with new credentials (rolling restart - no downtime)
kubectl get pods -w  # Watch pods restart
```

This behavior ensures credential rotation and secret updates are applied automatically without manual pod deletions.

#### Database Secrets

<ParamField path="secrets.DB_USER" type="string" default="">
  Database username (optional override).

  **Default Behavior:** If not set, the value from `envVars.DB_USER` is used (default: `"postgres"`).

  **When to Use:** Set this when the database username should be treated as sensitive information, or when you need to override the username configured in `envVars.DB_USER`.

  **Special Characters:** Usernames can safely contain special characters. The chart automatically handles URL encoding when constructing database connection strings.

  **Example:**

  ```yaml theme={null}
  secrets:
    DB_USER: "crewai_prod_user"
    DB_PASSWORD: "your-secure-password"
  ```

  **Related Configuration:** See `envVars.DB_USER` in [Environment Variables - Database Configuration](/reference/chart-values/environment-variables#database-configuration) for the non-sensitive username configuration.
</ParamField>

<ParamField path="secrets.DB_PASSWORD" type="string" default="">
  Database password.

  **Required:** Yes (for database access)

  **Security:** Use strong, unique passwords. Rotate regularly.

  **Special Characters:** Passwords can safely contain special characters (e.g., `@`, `:`, `/`, `?`, `#`, `%`). The chart automatically handles URL encoding when constructing database connection strings, so you don't need to manually escape or encode special characters.
</ParamField>

#### GitHub Integration Secrets

<ParamField path="secrets.GITHUB_TOKEN" type="string" default="">
  GitHub personal access token or OAuth token.

  **Auto-Populated:** From Replicated license field

  **Purpose:** Required to pull crewai enterprise repositories.
</ParamField>

<ParamField path="secrets.GITHUB_CREW_STUDIO_TOKEN" type="string" default="">
  GitHub token for Crew Studio integration.
</ParamField>

<ParamField path="secrets.GITHUB_CLIENT_SECRET" type="string" default="">
  GitHub App client secret for user authorization during installation.

  **Required For:** GitHub App OAuth flow.

  **Obtaining:** GitHub App Settings > Generate a new client secret.

  **Related Configuration:**

  * Configure `envVars.GITHUB_CLIENT_ID` with your GitHub App client ID
  * Configure `envVars.GITHUB_APP_ID` with your GitHub App ID
  * Configure `envVars.GITHUB_APP_URL` with your GitHub App installation URL
  * Configure `secrets.GITHUB_APP_PRIVATE_KEY` with your GitHub App private key

  **Setup Guide:** See [GitHub App Setup Guide](/features/github-app) for detailed instructions.
</ParamField>

<ParamField path="secrets.GITHUB_WEBHOOK_SECRET_TOKEN" type="string" default="">
  Secret token for validating GitHub webhook payloads.

  **Purpose:** Ensures webhooks are from GitHub.

  <Note>
    Conditional: only required when GitHub webhooks are Active. The recommended GitHub App setup (Step 5 of the GitHub App guide) disables webhooks — you only need this secret if you later activate GitHub webhooks.
  </Note>
</ParamField>

<ParamField path="secrets.GITHUB_APP_PRIVATE_KEY" type="string" default="">
  Private key for GitHub App server-to-server authentication.

  **Format:** PEM-encoded RSA private key as a **single-line string** with literal `\n` characters replacing each line break. The value must start with `-----BEGIN RSA PRIVATE KEY-----` — do not use the key fingerprint (the short hex string shown in the GitHub UI).

  **Obtaining:** GitHub App Settings > Private keys > Generate a private key. The `.pem` key file downloads automatically and cannot be retrieved again.

  **Required For:** GitHub App API authentication and operations.

  **Security:** Store securely and never commit to version control.

  For instructions on converting your `.pem` file to single-line format, see [Formatting the Private Key](/features/github-app#formatting-the-private-key).

  **Example:**

  ```yaml theme={null}
  secrets:
    GITHUB_APP_PRIVATE_KEY: "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA...\n...\n-----END RSA PRIVATE KEY-----\n"
  ```

  **Setup Guide:** See [GitHub App Setup Guide](/features/github-app) for detailed instructions.
</ParamField>

#### Rails Application Secrets

<Warning>
  **Do not set `RAILS_MASTER_KEY`:** The chart uses a different Rails configuration approach and does not require `RAILS_MASTER_KEY`. If you include this in your configuration, you will receive a warning during installation. Remove `RAILS_MASTER_KEY` from both `envVars` and `secrets` sections.
</Warning>

<ParamField path="secrets.SECRET_KEY_BASE" type="string">
  Rails secret key base for session signing and encryption.

  **Default:** Auto-generated

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).

  **Upgrade Behavior:** Once generated, the value persists across Helm upgrades to maintain session continuity.
</ParamField>

<ParamField path="secrets.CREWAI_PLUS_INTERNAL_API_KEY" type="string" default="">
  Internal API key for service-to-service authentication.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.ENCRYPTION_KEY" type="string" default="">
  Application-level encryption key for sensitive data at rest.

  **Auto-Generation:** If not provided, automatically generated and persisted across upgrades via `lookup` function.

  **Format:** Hexadecimal string (recommended: 64 characters).

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -hex 32
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY" type="string" default="">
  Primary encryption key for Rails Active Record Encryption.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY" type="string" default="">
  Deterministic encryption key for Rails Active Record Encryption. Used for attributes that need to be queried by encrypted value.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT" type="string" default="">
  Salt used for key derivation in Rails Active Record Encryption.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.FACTORY_DEBUG_TOKEN" type="string" default="">
  Token that authorizes `GET /health/debug` via the `X-Factory-Debug-Token` header. The endpoint returns `404 Not Found` to any caller without a valid token or a signed-in `factory-admin` session — the probe does not run for unauthorized requests. This prevents anonymous amplification of LLM-provider, Kubernetes API, and in-cluster service probes.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **Retrieve the current value:**

  ```bash theme={null}
  kubectl get secret <release-name>-secrets -n <namespace> \
    -o jsonpath='{.data.FACTORY_DEBUG_TOKEN}' | base64 -d
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).

  **Operational Guide:** See [Factory Health & Debug](/factory-health) for how the token is used and how to verify OAuth key consistency across pods.
</ParamField>

<ParamField path="secrets.REGISTRY_HTTP_SECRET" type="string" default="">
  Shared secret for the internal container registry's HTTP authentication.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 32` and persisted across upgrades via `lookup` function.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 24 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.OIDC_PRIVATE_KEY" type="string" default="">
  RSA private key (PEM) used to sign OIDC tokens issued by the platform's built-in IdP. The corresponding public key is published at `/oauth2/jwks` for cloud-provider workload-identity federation.

  **Auto-Generation:** If not provided, an RSA key is generated via Helm's `genPrivateKey "rsa"` and persisted across upgrades via `lookup` function.

  **Stability requirement:** Cloud-provider trust policies (AWS IAM, GCP Workload Identity, Azure federated credentials) verify tokens against the public key served at the JWKS endpoint. Rotating this key invalidates all federated trust until the public key is republished and clients refresh.

  **Manual Generation:**

  ```bash theme={null}
  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.OIDC_KEY_ID" type="string" default="">
  Identifier (`kid`) advertised in the JWKS document and embedded in the JOSE header of every OIDC token. Cloud providers use it to look up the matching public key.

  **Auto-Generation:** If not provided, generated as `crewai-oidc-<random>` and persisted across upgrades via `lookup` function.

  **Stability requirement:** Must be stable for the lifetime of the signing key. Changing `OIDC_KEY_ID` without rotating `OIDC_PRIVATE_KEY` (or vice versa) breaks token verification.

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

#### SSL/TLS Secrets

<ParamField path="secrets.SSL_PRIVATE_KEY" type="string">
  PEM-encoded private key for application-level TLS.

  **Default:** Auto-generated (if `web.tls.autoGenerate: true`)

  **Auto-Generation:** When `web.tls.autoGenerate: true`, a self-signed certificate and key are generated and persisted across upgrades.

  **Manual Provision:**

  ```yaml theme={null}
  secrets:
    SSL_PRIVATE_KEY: |
      -----BEGIN PRIVATE KEY-----
      ...
      -----END PRIVATE KEY-----
  ```
</ParamField>

<ParamField path="secrets.SSL_CERTIFICATE" type="string">
  PEM-encoded certificate for application-level TLS.

  **Default:** Auto-generated (if `web.tls.autoGenerate: true`)

  **Format:** Can include certificate chain (server cert + intermediates).
</ParamField>

<ParamField path="secrets.CREW_SSL_CERT" type="string">
  SSL certificate for crew service communication.

  **Default:** Auto-generated (if `web.tls.autoGenerate: true`)
</ParamField>

<ParamField path="secrets.CREW_SSL_KEY" type="string">
  SSL private key for crew service communication.

  **Default:** Auto-generated (if `web.tls.autoGenerate: true`)
</ParamField>

#### AWS Secrets (Optional)

<ParamField path="secrets.AWS_ACCESS_KEY_ID" type="string" default="">
  AWS access key ID for S3 and other AWS services.

  **When Required:**

  * `STORAGE_SERVICE: amazon` with static credentials
  * Not using IAM roles (IRSA)

  **Production Recommendation:** Use IAM roles (IRSA) instead of static credentials.
</ParamField>

<ParamField path="secrets.AWS_SECRET_ACCESS_KEY" type="string" default="">
  AWS secret access key.
</ParamField>

#### Azure Secrets (Optional)

<ParamField path="secrets.AZURE_STORAGE_ACCESS_KEY" type="string" default="">
  Azure Storage account access key.

  **When Required:** `STORAGE_SERVICE: microsoft`
</ParamField>

<ParamField path="secrets.AZURE_CLIENT_SECRET" type="string" default="">
  Azure service principal client secret.
</ParamField>

#### Built-in LLM Secrets (Optional)

<ParamField path="secrets.BUILT_IN_LLM_API_KEY" type="string" default="">
  API key for built-in LLM provider.

  **Purpose:** Provides authentication for internal LLM calls used by the CrewAI Platform, including:

  * Improving Studio prompts
  * Generating automation descriptions
  * Chatting with flows
  * Other platform AI-assisted features

  **When Required:** When using built-in LLM features (optional)

  **Provider-Specific Requirements:**

  **OpenAI:**

  * Obtain from: [https://platform.openai.com/api-keys](https://platform.openai.com/api-keys)
  * Format: `sk-proj-...` or `sk-...`

  **Anthropic:**

  * Obtain from: [https://console.anthropic.com/settings/keys](https://console.anthropic.com/settings/keys)
  * Format: `sk-ant-...`

  **Related Configuration:**

  * Configure `envVars.BUILT_IN_LLM_PROVIDER` to specify the LLM provider
  * Configure `envVars.BUILT_IN_LLM_MODEL` to specify the model

  **Example:**

  ```yaml theme={null}
  secrets:
    BUILT_IN_LLM_API_KEY: "sk-proj-abc123..."

  envVars:
    BUILT_IN_LLM_PROVIDER: "openai"
    BUILT_IN_LLM_MODEL: "gpt-4o-mini"
  ```
</ParamField>

#### Python Package Registry

<ParamField path="secrets.UV_DEFAULT_INDEX" type="string">
  PyPI registry URL for enterprise Python packages.

  **Default:** Auto-generated (in Replicated deployments)

  **Priority:** Manual configuration takes precedence over auto-generation. When `secrets.UV_DEFAULT_INDEX` is explicitly set, it overrides the auto-generated value from Replicated license credentials.

  **Auto-Generation (Replicated):** Automatically built from license credentials:

  * Customer ID from: `global.replicated.licenseFields.replicated_customer_id`
  * Password from: `global.replicated.dockerconfigjson` (registry.crewai.com entry)
  * Generated URL format: `https://customer_id:password@pypi.crewaifactory.com/simple/`

  **Manual Configuration:**

  ```yaml theme={null}
  secrets:
    UV_DEFAULT_INDEX: "https://username:password@pypi.your-registry.com/simple/"
  ```

  **Common Use Cases:**

  * **Private PyPI Mirror:** Point to a private registry mirror for air-gapped environments (see [Private PyPI Registry Mirror Guide](/configuration/private-pypi-mirror))
  * **Non-Replicated Deployments:** Provide direct access credentials when not using Replicated. To obtain your credentials for pypi.crewaifactory.com, log in to the customer portal at `https://enterprise.crewai.com/crewai` and navigate to your license details. Your customer ID and registry password are listed there. If you do not see them, contact CrewAI support.
  * **Custom Registry:** Use a different PyPI-compatible registry

  **Requirements:**

  * Must use HTTPS protocol
  * Must include authentication credentials in format `username:password@host`
  * Must end with `/simple/` for PyPI compatibility
  * Automatically base64-encoded by the chart

  **Purpose:** Provides access to CrewAI Enterprise Python packages for crew execution and platform functionality.

  **Validation:** The Helm test suite verifies proper URL format and structure.
</ParamField>

#### Authentication Provider Secrets

<Note>
  Most authentication provider configuration values have moved to `envVars` (non-sensitive).
  Client secrets and API keys remain in `secrets` for authentication providers.

  For complete authentication setup, see the [Environment Variables Authentication Configuration](/reference/chart-values/environment-variables#authentication-configuration) section.
</Note>

<Note>
  `WORKOS_COOKIE_PASSWORD` is configured under `envVars:` (not `secrets:`). See the WorkOS SSO guide for correct placement. Placing it under `secrets:` is silently ignored.
</Note>

<ParamField path="secrets.ENTRA_ID_CLIENT_SECRET" type="string" default="">
  Microsoft Entra ID (Azure AD) application client secret for web application authentication.

  **When Required:** `AUTH_PROVIDER: entra_id`

  **Obtaining:** Azure Portal > App Registrations > Your App > Certificates & Secrets > Client secrets.

  For the complete Entra ID Helm configuration and Azure portal setup, see [Entra ID SSO](/features/entra-id).

  **Security:** Keep this value secure. Rotate regularly according to your organization's security policy.
</ParamField>

<ParamField path="secrets.OKTA_CLIENT_SECRET" type="string" default="">
  Okta application client secret for web application authentication.

  **When Required:** `AUTH_PROVIDER: okta`

  **Obtaining:** Okta Admin Console > Applications > Your App > General Settings > Client Credentials.

  For the complete Okta configuration and setup steps, see [Okta SSO](/features/okta-sso).

  **Security:** Keep this value secure. Rotate regularly according to your organization's security policy.
</ParamField>

<ParamField path="secrets.WORKOS_API_KEY" type="string" default="">
  WorkOS API key for authentication.

  <Warning>
    Known issue (all current chart versions): `WORKOS_API_KEY` is accepted under `secrets:` in your values file but is **not rendered** into the Kubernetes Secret by the chart template. As a result, the key is silently absent from pod environment variables, causing WorkOS authentication to fail.

    **Required placement:** Put `WORKOS_API_KEY` under `envVars:` instead of `secrets:`. Note that `envVars:` stores the value in a ConfigMap rather than a Kubernetes Secret — treat it accordingly.

    The schema entry exists for historical reasons and will be removed in a future release. Until then, do not rely on IDE YAML autocompletion for this field.
  </Warning>

  **When Required:** `AUTH_PROVIDER: workos`

  **Obtaining:** WorkOS Dashboard > Main Page > API Keys.

  **Format:** Typically starts with `sk_live_` for production or `sk_test_` for testing.

  **Example (correct placement):**

  ```yaml theme={null}
  envVars:
    AUTH_PROVIDER: "workos"
    WORKOS_CLIENT_ID: "client_01HXYZ123ABC456"
    WORKOS_AUTHKIT_DOMAIN: "company.authkit.app"
    WORKOS_COOKIE_PASSWORD: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
    WORKOS_API_KEY: "sk_live_abc123..."   # Place here, NOT under secrets:
  ```

  **Security:** Keep this value out of version control. Supply it via `--set` or a gitignored values file. After installing, verify it is present in the pod environment:

  ```bash theme={null}
  kubectl exec -it deploy/crewai-web -- env | grep WORKOS_API_KEY
  ```
</ParamField>

<ParamField path="secrets.KEYCLOAK_CLIENT_SECRET" type="string" default="">
  Keycloak client secret for web application authentication.

  **When Required:** `AUTH_PROVIDER: keycloak`

  **Obtaining:** Keycloak Admin Console > Clients > Your Client > Credentials tab.

  For the complete Keycloak configuration and setup steps, see [Keycloak SSO](/features/keycloak-sso).

  **Security:** Keep this value secure. Rotate regularly according to your organization's security policy.
</ParamField>

#### Built-in Integrations Secrets

<Note>
  OAuth secrets are used when `oauth.enabled: true`. These secrets enable secure communication between the Built-in Integrations service and the Rails application for third-party integrations (Gmail, Google Calendar, Microsoft Outlook, etc.).
</Note>

<ParamField path="secrets.OAUTH_COOKIE_SECRET" type="string" default="">
  Secret key for signing OAuth session cookies.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Purpose:** Secures OAuth flow session data.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.OAUTH_DB_ENCRYPTION_KEY" type="string" default="">
  Encryption key for OAuth tokens stored in the database.

  **Auto-Generation:** If not provided, automatically generated as a 64-character hexadecimal string and persisted across upgrades.

  **Format:** Hexadecimal string (64 characters).

  **Purpose:** Encrypts sensitive OAuth tokens (access tokens, refresh tokens) at rest.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -hex 32
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).
</ParamField>

<ParamField path="secrets.OAUTH_INTERNAL_API_KEY" type="string" default="">
  Internal API key for authentication between the Built-in Integrations service and Rails application.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades.

  **Important:** This value is automatically duplicated as `CREWAI_OAUTH_API_KEY` for the Rails application. Both keys will always have the same value.

  **Purpose:** Enables secure service-to-service communication for OAuth operations.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).

  **Note:** When set manually, both `OAUTH_INTERNAL_API_KEY` (used by Built-in Integrations service) and `CREWAI_OAUTH_API_KEY` (used by Rails) will use this value automatically.
</ParamField>

#### OAuth Provider Secrets

OAuth provider secrets are optional and only required if you want to enable specific OAuth integrations. Each provider requires a client ID and client secret obtained from the provider's developer console.

<Note>
  **Configuration:** OAuth provider credentials are configured via `oauth.secrets.*` values in your Helm values file, which support provider-level defaults and product-specific overrides. See the [CrewAI Built-in Integrations Reference - OAuth Secrets Configuration](/reference/chart-values/oauth#oauth-secrets-configuration) for detailed configuration examples.

  For example, to configure Google OAuth for all Google products:

  ```yaml theme={null}
  oauth:
    secrets:
      google:
        clientId: "123456789-abcdefg.apps.googleusercontent.com"
        clientSecret: "GOCSPX-abc123..."
  ```

  The secrets documented below are the **Kubernetes secret keys** that are automatically generated from your `oauth.secrets.*` configuration.
</Note>

**Google OAuth Providers:**

<ParamField path="secrets.GOOGLE_GMAIL_CLIENT_ID" type="string" default="">
  Google OAuth client ID for Gmail integration.
</ParamField>

<ParamField path="secrets.GOOGLE_GMAIL_CLIENT_SECRET" type="string" default="">
  Google OAuth client secret for Gmail integration.
</ParamField>

<ParamField path="secrets.GOOGLE_CAL_CLIENT_ID" type="string" default="">
  Google OAuth client ID for Google Calendar integration.
</ParamField>

<ParamField path="secrets.GOOGLE_CAL_CLIENT_SECRET" type="string" default="">
  Google OAuth client secret for Google Calendar integration.
</ParamField>

<ParamField path="secrets.GOOGLE_DRIVE_CLIENT_ID" type="string" default="">
  Google OAuth client ID for Google Drive integration.
</ParamField>

<ParamField path="secrets.GOOGLE_DRIVE_CLIENT_SECRET" type="string" default="">
  Google OAuth client secret for Google Drive integration.
</ParamField>

<ParamField path="secrets.GOOGLE_CONTACTS_CLIENT_ID" type="string" default="">
  Google OAuth client ID for Google Contacts integration.
</ParamField>

<ParamField path="secrets.GOOGLE_CONTACTS_CLIENT_SECRET" type="string" default="">
  Google OAuth client secret for Google Contacts integration.
</ParamField>

<ParamField path="secrets.GOOGLE_SHEETS_CLIENT_ID" type="string" default="">
  Google OAuth client ID for Google Sheets integration.
</ParamField>

<ParamField path="secrets.GOOGLE_SHEETS_CLIENT_SECRET" type="string" default="">
  Google OAuth client secret for Google Sheets integration.
</ParamField>

<ParamField path="secrets.GOOGLE_SLIDES_CLIENT_ID" type="string" default="">
  Google OAuth client ID for Google Slides integration.
</ParamField>

<ParamField path="secrets.GOOGLE_SLIDES_CLIENT_SECRET" type="string" default="">
  Google OAuth client secret for Google Slides integration.
</ParamField>

<ParamField path="secrets.GOOGLE_DOCS_CLIENT_ID" type="string" default="">
  Google OAuth client ID for Google Docs integration.
</ParamField>

<ParamField path="secrets.GOOGLE_DOCS_CLIENT_SECRET" type="string" default="">
  Google OAuth client secret for Google Docs integration.
</ParamField>

**Microsoft OAuth Providers:**

<ParamField path="secrets.MICROSOFT_OUTLOOK_CLIENT_ID" type="string" default="">
  Microsoft OAuth client ID for Outlook integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_OUTLOOK_CLIENT_SECRET" type="string" default="">
  Microsoft OAuth client secret for Outlook integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_ONEDRIVE_CLIENT_ID" type="string" default="">
  Microsoft OAuth client ID for OneDrive integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_ONEDRIVE_CLIENT_SECRET" type="string" default="">
  Microsoft OAuth client secret for OneDrive integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_TEAMS_CLIENT_ID" type="string" default="">
  Microsoft OAuth client ID for Teams integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_TEAMS_CLIENT_SECRET" type="string" default="">
  Microsoft OAuth client secret for Teams integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_SHAREPOINT_CLIENT_ID" type="string" default="">
  Microsoft OAuth client ID for SharePoint integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_SHAREPOINT_CLIENT_SECRET" type="string" default="">
  Microsoft OAuth client secret for SharePoint integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_EXCEL_CLIENT_ID" type="string" default="">
  Microsoft OAuth client ID for Excel integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_EXCEL_CLIENT_SECRET" type="string" default="">
  Microsoft OAuth client secret for Excel integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_WORD_CLIENT_ID" type="string" default="">
  Microsoft OAuth client ID for Word integration.
</ParamField>

<ParamField path="secrets.MICROSOFT_WORD_CLIENT_SECRET" type="string" default="">
  Microsoft OAuth client secret for Word integration.
</ParamField>

**Other OAuth Providers:**

<ParamField path="secrets.HUBSPOT_CLIENT_ID" type="string" default="">
  HubSpot OAuth client ID.
</ParamField>

<ParamField path="secrets.HUBSPOT_CLIENT_SECRET" type="string" default="">
  HubSpot OAuth client secret.
</ParamField>

<ParamField path="secrets.NOTION_CLIENT_ID" type="string" default="">
  Notion OAuth client ID.
</ParamField>

<ParamField path="secrets.NOTION_CLIENT_SECRET" type="string" default="">
  Notion OAuth client secret.
</ParamField>

#### Wharf Secrets

<Note>
  Wharf secrets are used when `wharf.enabled: true`. These secrets enable secure communication between the Wharf OTLP trace collector and the Rails application for distributed tracing.
</Note>

<ParamField path="secrets.WHARF_JWT_SECRET" type="string" default="">
  JWT secret for authenticating trace submissions to the Wharf service.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Purpose:** Shared secret between the Wharf service and Rails application for authenticating OTLP trace submissions.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).

  **Important:** This value is automatically shared with both the Wharf service and the Rails application. Both components will use the same value for authentication.

  **Related Configuration:**

  * Wharf service: See [Wharf OTLP Trace Collector Reference](/reference/chart-values/wharf)
</ParamField>

<ParamField path="secrets.WHARF_POSTGRES_URL" type="string" default="">
  PostgreSQL connection string for the Wharf OTLP trace collector database.

  **Auto-Generated:** Automatically constructed from database configuration values and not directly user-configurable.

  **Format:** `postgres://username:password@host:port/database`

  **Components Used:**

  * Host: `envVars.DB_HOST` or `postgres.fullnameOverride` (if internal PostgreSQL enabled)
  * Port: `envVars.DB_PORT` (default: "5432")
  * User: `envVars.DB_USER`
  * Password: `secrets.DB_PASSWORD`
  * Database: `postgres.wharfDatabase` (default: "wharf")

  **Special Character Handling:** Username and password values are automatically URL-encoded when constructing the connection string. This ensures database credentials containing special characters (e.g., `@`, `:`, `/`, `?`, `#`, `%`) work correctly without manual escaping.

  **SSL Mode:** Uses PostgreSQL default SSL mode (`prefer`). To enforce SSL connections on external databases, configure SSL enforcement at the database server level (e.g., AWS RDS parameter `rds.force_ssl=1`).

  **Purpose:** Provides Wharf service with connection credentials to its dedicated PostgreSQL database for storing OTLP trace data.

  **Related Configuration:**

  * Wharf service: See [Wharf OTLP Trace Collector Reference](/reference/chart-values/wharf)
  * PostgreSQL database: See [PostgreSQL Configuration](/reference/chart-values/postgres)
</ParamField>

#### Deployment Instance Secrets

<Note>
  The deployment instance JWT secret signs the access and refresh tokens the platform mints for each crew instance it provisions. Deployed crews (BUILDKIT\_KUBERNETES, ECS, etc.) attach these tokens when calling back into the platform's internal API for execution status, refresh, and configuration.
</Note>

<ParamField path="secrets.DEPLOYMENT_INSTANCE_JWT_SECRET" type="string" default="">
  HMAC-SHA256 signing key for the JWT access and refresh tokens issued to deployed crew instances.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Purpose:** Signs short-lived access tokens (24h) and long-lived refresh tokens (1 year on factory installs) that deployed crews use to call back into the platform's internal API. When unset, the platform refuses to mint refresh tokens and falls back to access-token-only auth — deployed crews stop working once their access token expires.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -hex 32
  ```

  Or, to match the chart's auto-generation format exactly:

  ```bash theme={null}
  ruby -rsecurerandom -e 'puts SecureRandom.alphanumeric(64)'
  ```

  **Rotation Warning:** Rotating this secret invalidates **every** refresh token already handed out to a deployed crew — they are signed with the previous key and will fail verification on the next refresh. The daily `ScanExpiringDeploymentTokensJob` only re-mints tokens within 48h of expiring, so it does not recover crews on its own. To rotate safely, redeploy every active automation after the change so each instance picks up a token signed with the new key. Treat rotation as a deliberate operation.

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).

  **Upgrade Behavior:** Once generated, the value persists across Helm upgrades via the `lookup` function so existing deployment refresh tokens remain valid.
</ParamField>

#### Cube Analytics Secrets

<Note>
  Cube secrets are used when `cube.enabled: true`. These secrets enable authentication between the Cube analytics service and the Rails application for cost tracking and execution analytics.
</Note>

<ParamField path="secrets.CUBE_JWT_SECRET" type="string" default="">
  JWT secret for authenticating requests between the Cube analytics service and the Rails application.

  **Auto-Generation:** If not provided, automatically generated using `randAlphaNum 64` and persisted across upgrades via `lookup` function.

  **Purpose:** Shared secret between the Cube service and Rails application for authenticating analytics queries and data access.

  **Manual Generation:**

  ```bash theme={null}
  openssl rand -base64 48 | tr -d '\n'
  ```

  **ArgoCD Users:** Must be set explicitly — see [ArgoCD Deployment Guide](/configuration/argocd).

  **Important:** This value is automatically shared with both the Cube service and the Rails application. Both components will use the same value for authentication.

  **Related Configuration:**

  * Cube service: See [Cube Analytics Reference](/reference/chart-values/cube)
</ParamField>

***