> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Handle credentials generated for a private TrustGate gateway.

## Wizard-issued credentials

The console issues credentials **per product instance** before you deploy. Create
each product you run — TrustGate under **Agent Gateway** and TrustGuard under
**Agent Runtime** — and collect its own set. See
[Console setup](/neuraltrust/deployment/console-setup) for the step-by-step flow.

Each private instance issues:

* A configuration-sync token, scoped to that gateway or TrustGuard
* A DataAgent enrollment token that authorizes OTLP metadata egress and DataBridge retrieval

The Docker command injects the configuration-sync token, DataAgent enrollment token, and a generated local cache key. The maintained Compose manifest also requires operator-supplied `SERVER_SECRET_KEY`, `CONFIG_SYNC_GRPC_ENDPOINT`, and `DATABRIDGE_ADDR`.

The Kubernetes wizard currently writes credentials directly into generated `values.yaml`; it does not place them in Kubernetes Secret references. Treat the entire generated file as a secret and never commit it. For production, move the credentials into pre-created Kubernetes Secrets or an approved secret manager and map them through the current maintained chart interfaces.

Manual displays only `CONTROL_PLANE_JWT` and `DATA_AGENT_JWT`. Never print credentials in logs or share them in tickets.

Regenerating install configuration from **Settings → Agent Gateway → Deployment** issues new install credentials.

## Chart-managed secrets

For an operator-managed Kubernetes deployment that uses a maintained Helm chart, these settings control runtime secret generation:

```yaml theme={null}
global:
  autoGenerateSecrets: true
  preserveExistingSecrets: false
```

For GitOps, pre-create Secrets and set `autoGenerateSecrets: false` with `preserveExistingSecrets: true`. `helm template` cannot preserve generated values via `lookup`.

## Data-plane secrets

| Kubernetes Secret                  | Important keys                                                               | When                                     |
| ---------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------- |
| TrustGate (`agentgateway-secrets`) | `SERVER_SECRET_KEY`, `STS_SIGNING_KEY`                                       | Always                                   |
| `trustguard-secrets`               | `ADMIN_JWT_SECRET`, `TRUSTGUARD_TOKEN_SIGNING_SECRET`, `REDIS_EVENTS_SECRET` | Always                                   |
| `trustguard-client-credentials`    | `CLIENT_ID`, `CLIENT_SECRET`                                                 | Always                                   |
| `postgresql-secrets`               | `DB_*`, `POSTGRES_*`, `DATABASE_URL`, …                                      | Always (your Postgres)                   |
| `redis-secrets`                    | `REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD`, …                              | Always (your Redis)                      |
| `firewall-secrets`                 | `JWT_SECRET`                                                                 | Firewall enabled                         |
| `dataagent-secrets`                | `ENROLMENT_TOKEN` (+ DB keys if needed)                                      | DataAgent / DataBridge retrieval enabled |

## Credential contracts

* The configuration-sync token authenticates the data plane's outbound configuration pull from the SaaS control plane.
* The OTLP token authenticates metadata export to the generated collector endpoint.
* The DataAgent enrollment token is separate and authorizes DataAgent and DataBridge retrieval.
* The LLM and MCP URLs are not secrets. Configure them separately in **Settings → Agent Gateway → General**.

## Regional high availability

Every regional data plane needs the gateway-scoped configuration-sync credential and a valid `CONFIG_SYNC_LKG_KEY`. Store the encrypted last-known-good file on persistent storage so the region can restart while the control plane is unavailable.

Only the active region should run the enrolled DataAgent. Keep the enrollment token protected in passive regions and enable the DataAgent only as part of a fenced promotion. See [High availability](/neuraltrust/deployment/high-availability).

## Chart references

**Metadata (OTLP)** — when using an existing Kubernetes Secret:

```yaml theme={null}
global:
  clickstack:
    existingSecret:
      name: clickstack-otlp-token
      key: OTEL_EXPORTER_OTLP_HEADERS
```

**DataAgent** — reference the wizard-issued enrollment token from a Secret:

```yaml theme={null}
dataagent:
  tenantId: "<TENANT_ID>"
  enrolmentTokenExistingSecret:
    name: dataagent-enrolment
    key: ENROLMENT_TOKEN
```

Keep configuration-sync, OTLP, and DataAgent enrollment tokens out of values files and source control.

## Registry

Create `gcr-secret` (or set `global.imagePullSecrets`) yourself — the chart does not create registry credentials.

Full key lists live in the chart repository `SECRETS.md`.