Skip to main content
An Admin manages tenant secrets in Console. An Operator manages platform-provided secrets in the operator panel. Only an Admin manages destination definitions.

​
Understand secret lookup

A definition declares a secret name, such as apify-api-token. It never contains the value. Secrets have no workspace scope in this deployment model. Lookup checks the Console value first. A revoked tenant version stops lookup; it does not fall back. An Admin must delete that tenant secret to return to the operator value.

​
Create, rotate or revoke securely

  1. Open the secrets page for the level you manage.
  2. Inspect the exact name and its listed consumers.
  3. Enter or rotate the value through the secure form.
  4. Inspect the saved status without copying the value into chat or ordinary configuration.
  5. Test an authorised consumer and inspect its recorded secret version and outcome.
Nobody can read a stored value, including its manager. A platform-generated value is shown once at creation. Capture it only in the intended secure destination. Rotation affects new admission. An in-flight or recovered ingestion run keeps its recorded secret version. Revoking that version stops future delivery of it, including to a running attempt. Deletion can be blocked while a recorded run is active or during its late-usage reconciliation period. Resolve the consumer state before retrying deletion. Every signed-in user can inspect secret names and status. That does not disclose values or grant Console management. Private consumer titles remain hidden.

​
Configure a destination

In Forge → Destinations, create or edit the permitted HTTPS webhook or TAK destination. Declare its secret names and security label limit. Inspect the address, intended recipients and data permitted to leave. Publish the definition only after the required secrets are usable. Send a test and inspect each delivery outcome. A destination’s successful test does not prove that every future classified payload is permitted. Watch owners can select the destination by name, kind and label limit. They do not receive its private connection settings.

​
Handle updates and failures

Alert delivery uses the newest published destination version. Revoking that newest version stops the destination without falling back to an earlier version. Inspect connection errors, refused addresses, invalid secrets and destination responses separately. Failed delivery to one destination does not stop every other destination. Tenant-supplied provider keys are paid directly by the tenant. Platform-provided keys follow the platform’s usage pricing. Verify the actual billing arrangement in Set budgets and billing ownership.