Guides
App-secret requirements
Generate app secrets and use protected entry for external credentials.
For agents: Read the complete native guide and current
context.getcapabilities. Use only implemented operations and preserve exact Account, app and environment authority.
Declare generated app-secret requirements alongside apps.apply, for example {"name":"SESSION_SECRET","ensure":"generated","bytes":32}. The platform generates and stores the value without exposing it to source, an agent transcript or browser code. Redeployments preserve the owned revision.
An external secret uses ensure:external with the provider and purpose. A waiting operation returns a protected browser action for the authorized person. It is a real dependency, unlike an automatically generated session secret. Continue the same operation after entry; do not invent a value or ask the person to paste it into chat.
Rotation, deletion and copying a secret are explicit privileged actions with current app/epoch/revision checks. The APIs return metadata, never plaintext. Changing a binding invalidates stale execution/preview authority and prior verification assumptions. A stopped app can retain encrypted secrets; deletion policy is separate from execution control.