AI AdminPanel Documentation

Use Secret References

A reference points to a stored secret instead of copying its value into an environment field. It resolves when containers are created; it is not a live update to an already running process.

Select, save and redeploy

  1. Open the consuming service's environment-variable editor.
  2. Choose use a stored secret, then select the relevant service or AI secret from the available owner-scoped choices.
  3. Save the value. A reference is displayed unmasked with a Reference tag because it contains a path, not the secret value.
  4. Resolve any validation warning, then redeploy the consumer and verify its connection to the application that owns the secret.

The picker and resolver use the same owner scope. Moving a service to another customer changes that scope, so review its references and dependencies before reassignment. Do not assume a pointer remains valid after a move or deletion.

A reference to a service secret (services/<service id>/<KEY>) resolves only while the consuming service and the referenced service have the same owner. If the referenced service has moved to another customer, validation reports secret not found and the next deploy or redeploy of the consumer stops before any container is touched. Pick a secret the current owner holds, or type the value in, then redeploy.

A reference can name a service secret or the owner's AI provider key (ai/<purpose>), which are the choices the picker offers. Organization API keys and the AI gateway key can't be referenced; use their own pages to copy them.

The path must be written exactly as the picker inserts it. A hand-edited reference with a leading or doubled slash, . or .., or a differently cased service ID is refused, not corrected.

After a rotation

A vault update does not rewrite running environments. After rotating a secret, redeploy other consuming services as needed and verify each connection. A missing reference must be resolved before deployment; do not replace it with a guessed credential to bypass an error.

Typed environment values remain supported and use their normal encrypted storage and reveal controls. See Secrets Manager for the limitations of encryption and host access.