Secrets & encryption
A configuration usually holds at least one thing you’d rather not have lying around — an API key, a database password, a client secret. qRaptor encrypts those at rest and never shows them again.
The Encrypted / Plain toggle
Every text field on a configuration form carries a small control at the right-hand end of its label — a lock icon and the word Encrypted, or an open lock and Plain. Click it to switch. Numbers, switches and dropdowns can’t hold a secret, so they have no such control.
| State | Meaning |
|---|---|
| Encrypted | The value is encrypted before it’s stored, and is never returned to the browser afterwards. |
| Plain | The value is stored as ordinary text and is visible on the configuration’s card. |
Fields the template already knows are sensitive start as Encrypted. You can mark any other text field encrypted too — useful when your own deployment treats something as sensitive that the template didn’t, like an internal hostname.
Before you save, a summary at the foot of the form tells you exactly how many fields will be encrypted and names them.
What you see afterwards
Once saved, an encrypted field shows on the configuration’s card as a row of dots, with a lock icon beside its name, and the card carries a N secrets badge counting them. That is all anyone sees — there is no reveal action, because the value genuinely isn’t sent back to the browser.
Values are decrypted only at run time, on the platform, at the moment an agent or tool actually needs them. They aren’t returned by the API that populates the Studio screens.
Editing a configuration that has secrets
This is the part worth knowing before you need it.
When you open a configuration to edit it, its encrypted fields are pre-filled with a placeholder rather than the real value. Leave that placeholder alone and the stored secret is kept exactly as it is. You can change the host, the port, the description — anything else — without re-entering the key.
To change a secret, clear the field and type the new value. It’s encrypted on save and replaces the old one.
This means rotating a credential is a two-field job: open the configuration, replace the one secret, save. Every tool and agent referencing it picks up the new value on their next run — nothing else needs touching.
What isn’t covered
- The configuration’s name is not a secret and can’t be changed after creation — see Add a configuration.
- Secrets are per project. A configuration in one project is not visible to another.
- Secret redaction on prompts is separate. qRaptor also strips credential-shaped text out of prompts on their way to a model, on every request, regardless of any configuration. That’s covered under LLM Policies.
Common issues
- You saved and the secret stopped working — check whether the field still held its placeholder when you meant to replace it, or whether you pasted a value with a trailing space or newline.
- A field you wanted encrypted isn’t — only text-shaped fields can be marked secret. Numbers, switches and multi-select fields have no toggle.
- A tool says a config value is missing — the configuration exists but the field the tool references may be empty, or the tool may reference a different field name. Open the configuration and compare against the tool’s
{{config.…}}reference.
Next
- Manage configurations — editing, disabling and finding things later.