API Client Secret Storage Settings
Reach this screen by following Administration → System Settings → API Client Secret Settings. The screen holds a single field, Default Storage Mode.
Storage Modes
| Mode | Behavior |
|---|---|
| Encrypted (Default) | The secret is kept in a form that can be shown again: a copy encrypted with the platform's own algorithm is always stored, and — when the installation has a recovery key (KEK) configured — an additional KEK-sealed recovery envelope. Revealable with or without a KEK. This is also the only mode that could ever support HTTP Digest authentication for an API client, though Digest support for API clients is not wired in this version regardless of storage mode. |
| Hashed | Only a one-way verifier is stored — nothing that could be turned back into the secret is kept anywhere, even when a recovery key is configured. The secret is shown once, at the moment it is issued or rotated; Reveal is permanently unavailable for a generation stored this way, and it can never support HTTP Digest. |
Verification never depends on the mode: a secret presented to the gateway is checked against its one-way verifier the same way in both modes. The mode only decides whether a recoverable copy is kept alongside that verifier.
Choosing the Mode
The mode is fixed on the individual secret generation the moment it is issued or rotated — not on the client as a whole, so different generations of the same client can carry different modes. The person issuing or rotating a secret chooses it directly, on the Client Secrets sub-tab's issue/rotate dialog: a Storage Mode control there is pre-selected to the installation default set here, and can be switched to the other mode for that one generation without changing the default. See Secret Storage Mode for how this reads on that screen.
Installation Default
GET /api/general-settings/api-client-secret
PUT /api/general-settings/api-client-secret
{
"defaultStorageMode": "ENCRYPTED"
}
| Field | Description |
|---|---|
defaultStorageMode | ENCRYPTED or HASHED. Applied to a secret generation whose issue/rotate request does not choose a mode of its own. |
Reading the setting requires no particular permission. Changing it requires system administrator permission.
Changing this default only affects generations issued or rotated after the change. It never re-stores a secret that already exists — a generation created under the previous default keeps whatever mode it was given at the time.
Upgrading from an Earlier Version
An installation upgraded from a version without this setting reads the default as Encrypted, with no migration step required. Every legacy credential password already stored, and every secret the automatic legacy-record migration carries over from one, is treated the same way: born Encrypted, and revealable through a platform-encrypted copy even on an installation with no recovery key configured.