What is an Auth Secret?
An Auth Secret is the private half of a Workspace-scoped Auth Key and Auth Secret pair, comparable to a password for secure automation. It must remain confidential and can be regenerated if compromised, and a Workspace can hold several active key pairs.
How Auth Secrets work
The Auth Secret is the private input used by trusted code to produce request signatures for its Workspace. The service can verify those signatures without the credential being transmitted as ordinary request data. It therefore belongs in a server-side secret store, distinct from the public Auth Key it pairs with and from short-lived signed parameters delivered to a client. Because several key pairs can coexist in one Workspace, verification is pair-specific: for example, webhook signatures must be checked with the Auth Secret belonging to the Auth Key used for that Assembly. Rotation is an operational event that must be coordinated across every signer.
Key facts
- 1Embedding the secret in browser JavaScript or a mobile binary makes it extractable; client uploads should receive server-generated signed request material instead.
- 2Regenerating a secret in place invalidates signatures created with the previous value. For a rotation without downtime, add another key pair, migrate signers, and then retire the old pair. Where required, identify the pair with its
auth_key, including in signed Smart CDN URLs. - 3Logs, error reports, and observability payloads need redaction because accidental diagnostic capture can compromise the credential even when source code is clean.
When Auth Secrets matter
Keep the Auth Secret on trusted servers and use it to sign requests without exposing it to browsers or mobile clients. Verify signatures with the secret that belongs to the Auth Key used for that request, and if a secret leaks, rotate it promptly and update every dependent integration.
Common use cases for platform workflows
These examples cover platform workflows broadly, not specifically Auth Secrets.
- Running repeatable upload, import, processing, AI, storage, and notification pipelines.
- Tracking long-running media work independently from an application request.
- Referencing centrally stored credentials by name instead of sending storage secrets with each request.
Working with platform workflows
This guidance covers platform workflows broadly, not just Auth Secrets.
A client authenticates and submits files or references together with workflow instructions. The platform validates the request, schedules dependent operations, records state transitions, and exposes results through a response, polling endpoint, or notification.
Platform concepts become reliable only when their lifecycle is explicit. Authentication, idempotency, retries, timeouts, observability, quotas, and terminal states should be designed together rather than added after failures occur.
What you gain
- Reusable workflows separate application intent from processing infrastructure.
- Stable job identifiers and lifecycle events improve observability and recovery.
- Managed queues and workers let products scale without embedding every media tool.
What it costs
- Synchronous responses are simple but keep connections open while long work executes.
- Aggressive retries improve recovery from transient faults but can duplicate work or overload a dependency.
- Higher concurrency reduces queue time until resource contention or a downstream limit becomes the bottleneck.
Before production
- 1Define authentication, authorization, idempotency, retries, and terminal error behavior.
- 2Observe queue time, execution time, callbacks, and partial results with stable identifiers.
- 3Exercise malformed, duplicate, interrupted, and unauthorized requests before launch.