Encrypted secrets
Every secret field of Settings is encrypted when it is saved and written to the configuration file as ENC:…. The server decrypts it when it loads the file, with the install's master key.
| Field | Settings |
|---|---|
| Pool password | Liberty Next → Administer → Pools |
| API connector credentials (password, token, client secret) | Liberty Next → Build → Connectors |
| Licence key, Anthropic API key, OIDC client secret, SMTP password | Liberty Next → Administer → App |
A secret field is a masked input with an eye to show its content. There is nothing to switch on: a value saved from Settings is always encrypted, and the save is refused when the server has no master key.
To give a secret from the environment instead, write ${VARIABLE} in the file; to write an ENC: value by hand, use liberty-crypto encrypt. The details — the key, its derivation, <NAME>_FILE secrets — are on Encryption & secrets.
Keep a copy of the master key outside the server and never change it on an existing install: every ENC: value would become unreadable. ./liberty doctor checks that it decrypts every pool password.