> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apowerb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> What each secret protects, and what breaks if you rotate it.

## ENCRYPT\_KEY

`ENCRYPT_KEY` does double duty: Fernet encryption at rest, and JWT signing. It must be
a urlsafe-base64 32-byte key — the output of `Fernet.generate_key()`.

It encrypts the OAuth access and refresh tokens of every connected integration.
**Changing it makes all already-connected integrations unreadable.** Back it up
alongside your other secrets.

`scripts/generate-secrets.sh` in `apowerb-hosting` never replaces a value that is
already set, precisely to avoid this.

## RAG\_WEBHOOK\_SECRET

Signs the completion callbacks sent by the RAG service. It ships with a documented
default value, which means it is not a secret until you change it.

<Warning>
  A configuration value that *looks* filled in is not the same as one that is
  configured. Compare the deployed value against the literal in `.env.example` before
  calling a secret set — a placeholder in quotes reads as a real value at a glance.
</Warning>

## Empty is not unset

An environment variable set to the empty string is present. Code that falls back with
`??` (nullish coalescing) or `os.getenv(name, default)` will accept `""` and skip the
default. Where a value is required, assert it is non-empty at startup and refuse to
boot otherwise.


## Related topics

- [Quickstart](/quickstart.md)
- [Configuration](/configuration.md)
- [th2rag](/ecosystem/th2rag.md)
- [RAG](/guides/rag.md)
- [Rag Webhook](/api-reference/rag/rag-webhook.md)