Store installation secrets and state
Keep installation secrets on the server and use installation state for small durable values such as a sync cursor. You need a scoped installation token and the app UUID. Inspect current secret names or state before updating them.
Installation secrets vault
Section titled “Installation secrets vault”Use the vault for tokens and keys the function needs at runtime that are not your OAuth client credentials.
Caraer injects the decrypted map as body.secrets on webhook, lifecycle,
and app-bar invokes (empty object when none are set). The HTTP API is
write-oriented so a leaked Bearer cannot dump values:
| Method | Path | Returns |
|---|---|---|
GET |
/v2/apps/{appUuid}/installation/secrets |
Secret names only |
PUT |
/v2/apps/{appUuid}/installation/secrets/{name} |
Body { "value": "…" } |
DELETE |
/v2/apps/{appUuid}/installation/secrets/{name} |
— |
caraer apps secrets listCap is 64 secrets per install. Prefer the injected body.secrets in a
handler; call PUT when you need to persist a token you obtained yourself
(for example a provider that is not an externalOAuthProviders entry).
Related install APIs (same Bearer):
| Method | Path | Purpose |
|---|---|---|
GET / PUT |
/v2/apps/{appUuid}/installation/state |
Cursors, watermarks (max 256KB) |
POST |
/v2/apps/{appUuid}/installation/jobs |
{ "functionName", "payload", "delaySeconds"? } |
local dev emulates state, secrets, and jobs. It does not run the real
provider OAuth callback.
Verify without exposing credentials
Section titled “Verify without exposing credentials”Read back secret names and the intended non-secret state after a write. Secret values are not returned by a listing. Use background jobs for deferred work rather than putting credentials in a job payload.