{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/deployment/reference/auth-secrets","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/deployment/reference/auth-secrets","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/deployment/reference/auth-secrets","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/reference/auth-secrets","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/reference/auth-secrets","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/reference/auth-secrets","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/reference/auth-secrets","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Secret management for authentication","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"secret-management-for-authentication","__idx":0},"children":["Secret management for authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page to understand the Kubernetes secret names and keys used by the authentication components in ","Ripple Custody",". The examples show possible secret shapes; your secret manager, namespace, rotation process, and credential values depend on your deployment."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page applies to on-premise deployments only. For current defaults and the full supported schema, use the configuration packaged with your release."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-this-config-controls","__idx":1},"children":["What this config controls"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authentication services use Kubernetes secrets for database access, service credentials, OIDC integration, OAuth signing keys, and client secrets."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Some secrets are supplied by the deployment operator. Other secrets are generated or managed by the deployment configuration."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"secret-fields","__idx":2},"children":["Secret fields"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"keycloak-secrets","__idx":3},"children":["Keycloak secrets"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Secret"},"children":["Secret"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Key"},"children":["Key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-psql"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_DB_URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JDBC connection string for the Keycloak database schema."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-psql"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PG_CONN_URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PostgreSQL connection string used by Keycloak."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-kc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KEYCLOAK_ADMIN"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keycloak admin username."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-kc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KEYCLOAK_ADMIN_PASSWORD"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keycloak admin password."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-kc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_BOOTSTRAP_ADMIN_USERNAME"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bootstrap admin username."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-kc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_BOOTSTRAP_ADMIN_PASSWORD"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bootstrap admin password."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-kc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_BOOTSTRAP_ADMIN_CLIENT_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bootstrap admin client ID."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-oidc-credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_SERVER_CLIENT_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID used by Keycloak to communicate with the OAuth server."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-oidc-credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_SERVER_CLIENT_SECRET"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client secret used by Keycloak to communicate with the OAuth server."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-clients"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Service client secrets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Internal service client secrets. This secret is managed automatically."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"oauth-server-secrets","__idx":4},"children":["OAuth server secrets"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Secret"},"children":["Secret"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Key"},"children":["Key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oauth-server"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_SERVER_KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Private key used by the OAuth server."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oauth-clients"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_CLIENTS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JSON document containing OAuth client definitions."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oauth-oidc-credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_SERVER_CLIENT_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID used for OIDC integration."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oauth-oidc-credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_SERVER_CLIENT_SECRET"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client secret used for OIDC integration."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oauth-psql"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POSTGRES_URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PostgreSQL connection string for the OAuth server database schema."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"constraints-and-relationships","__idx":5},"children":["Constraints and relationships"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication secrets must exist in the namespace where the authentication components read them."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Secret values should be supplied through your normal secret-management process."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keycloak-clients"]}," secret contains internal service client secrets and is managed automatically."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["OAuth private key material must be valid private key data in the format expected by the OAuth server."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Connection string values must match the PostgreSQL host, database, credentials, and schema used by your deployment."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example","__idx":6},"children":["Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This example shows a possible set of Kubernetes secrets for Keycloak and OAuth. Replace namespaces, connection strings, usernames, passwords, client secrets, and private key material with values from your own environment."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"apiVersion: v1\nkind: Secret\nmetadata:\n  name: keycloak-kc\n  namespace: harmonize\ntype: Opaque\nstringData:\n  KEYCLOAK_ADMIN: \"admin\"\n  KEYCLOAK_ADMIN_PASSWORD: \"<strong-password>\"\n  KC_BOOTSTRAP_ADMIN_USERNAME: \"admin\"\n  KC_BOOTSTRAP_ADMIN_PASSWORD: \"<strong-password>\"\n  KC_BOOTSTRAP_ADMIN_CLIENT_ID: \"<client-id>\"\n---\napiVersion: v1\nkind: Secret\nmetadata:\n  name: keycloak-psql\n  namespace: harmonize\ntype: Opaque\nstringData:\n  KC_DB_URL: \"jdbc:postgresql://postgres:5432/harmonize?currentSchema=keycloak\"\n  PG_CONN_URL: \"postgres://keycloak_user:<password>@postgres:5432/harmonize\"\n---\napiVersion: v1\nkind: Secret\nmetadata:\n  name: oauth-server\n  namespace: harmonize\ntype: Opaque\nstringData:\n  OAUTH_SERVER_KEY: |\n    -----BEGIN PRIVATE KEY-----\n    <private-key-material>\n    -----END PRIVATE KEY-----\n---\napiVersion: v1\nkind: Secret\nmetadata:\n  name: oauth-psql\n  namespace: harmonize\ntype: Opaque\nstringData:\n  POSTGRES_URL: \"postgres://oauth_user:<password>@postgres:5432/harmonize?schema=oauth\"\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"external-secret-managers","__idx":7},"children":["External secret managers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can use an external secret manager to materialize the Kubernetes secrets that ","Ripple Custody"," expects. The provider-specific configuration belongs to your secret-manager tooling."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This example shows the expected pattern: map remote secret values to the Kubernetes secret keys listed above."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"apiVersion: external-secrets.io/v1beta1\nkind: ExternalSecret\nmetadata:\n  name: oauth-server-key\n  namespace: harmonize\nspec:\n  refreshInterval: 1h\n  secretStoreRef:\n    name: <secret-store-name>\n    kind: SecretStore\n  target:\n    name: oauth-server\n    creationPolicy: Owner\n  data:\n    - secretKey: OAUTH_SERVER_KEY\n      remoteRef:\n        key: <remote-secret-name>\n        property: private_key\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-topics","__idx":8},"children":["Related topics"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/keycloak"},"children":["Keycloak configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/oauth-server"},"children":["OAuth server configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/networking"},"children":["Networking configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/postgresql"},"children":["PostgreSQL configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/governance/genesis/payload-reference"},"children":["Genesis payload reference"]}]}]}]},"headings":[{"value":"Secret management for authentication","id":"secret-management-for-authentication","depth":1},{"value":"What this config controls","id":"what-this-config-controls","depth":2},{"value":"Secret fields","id":"secret-fields","depth":2},{"value":"Keycloak secrets","id":"keycloak-secrets","depth":3},{"value":"OAuth server secrets","id":"oauth-server-secrets","depth":3},{"value":"Constraints and relationships","id":"constraints-and-relationships","depth":2},{"value":"Example","id":"example","depth":2},{"value":"External secret managers","id":"external-secret-managers","depth":2},{"value":"Related topics","id":"related-topics","depth":2}],"frontmatter":{"seo":{"title":"Secret management for authentication"}},"lastModified":"2026-07-27T10:10:43.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.38/deployment/reference/auth-secrets","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}