Strapi — self-hosted server secrets

strapi/server · version 1

envs add strapi/server

This declares the keys below in your catalog and sets none of them. A template is a schema for keys; it never carries a value.

Key	Needed	Kind	Notes
`APP_KEYS`	required	secret	Comma-separated keys that sign cookies. Generated for you by strapi new when absent. Strapi does not label these secret in prose, but they sign sessions, so they are treated as secret here.. where to get it
`API_TOKEN_SALT`	required	secret	Salts API tokens. Changing it invalidates every token already issued, which is a blunt way to revoke all of them at once and a bad accident otherwise.. where to get it
`ADMIN_JWT_SECRET`	required	secret	Signs admin panel sessions.. where to get it
`JWT_SECRET`	required	secret	Signs sessions for the users and permissions plugin.. where to get it
`TRANSFER_TOKEN_SALT`	optional	secret	Salts data transfer tokens.. where to get it
`ENCRYPTION_KEY`	optional	secret	Encrypts stored values.. where to get it