Secrets
Platform keys stored encrypted: email and SMS, WhatsApp, chat widget, push notifications, SMTP, object storage, webhooks, code signing and CAPTCHAs.
Where:
/admin/secretsWho: Platform super-adminsGroups
- Email & Marketing (Brevo: API key, Brevo sender email — a sender verified in Brevo; sign-in codes and all emails use it), Email (SMTP fallback)
- WhatsApp (BSP access token, phone-number ID, webhook verify token, app secret)
- Silux Chat widget, Push notifications (FCM, APNS)
- Object storage (S3 / MinIO), Webhooks (Slack, Teams, Zapier, Make.com)
- Code signing for branded installers (Windows PFX, Apple notarisation, Android keystore)
- CAPTCHAs (reCAPTCHA, Cloudflare Turnstile)
Each entry shows Not configured or its state. Add / Replace a value and Save; values are never shown again. “No hardcoded keys.”
Careful: Outbound email, WhatsApp alerts and phone push only work once their keys are stored here.