Secret management

Bearer secrets are displayed once. Service and personal credentials persist only as SHA-256 hashes; webhook signing secrets are encrypted beneath the owner-only data directory.

Creation

Name: production-importer
Kind: Service account
Scopes: records:read,records:write

Copy the returned value directly into the workload's secret manager. Do not place it in source, URLs, screenshots, browser bundles or ordinary logs.

Rotation without downtime

1. Create a replacement with the same or narrower scopes.
2. Deploy the replacement secret to the workload.
3. Verify successful requests and updated last-used metadata.
4. Revoke the old credential.
5. Remove the retired secret from every environment and CI variable.

Incident response

Revoke a suspected credential immediately and inspect request-correlated audit facts. Because only a hash persists, Trestle cannot recover or display a lost bearer secret; create a replacement instead.

Separate identities

Use one credential per workload and environment. Personal tokens should have a human owner; service accounts should represent deployed systems. AWS credentials remain process configuration and are never copied into a Trestle bearer token.