Secrets

Secrets

Secrets keep sensitive values out of adapter configs while still making them available to agents at runtime.

Use this page when you need to understand the default secret provider, configure strict mode, or migrate inline credentials into managed secret references.

---

Default Provider

The built-in provider is localencrypted.

It stores secret material using a local master key at:

txt ~/.paperclip/instances/default/secrets/master.key

That key is created automatically during onboarding and remains local to the machine unless you override it.

> Note: The default provider is designed for local and single-machine use. For other deployment patterns, keep the same secret model but verify the surrounding infrastructure carefully.