Secrets and encryption

Areca needs a handful of secrets from you: the values that sign sessions, connect to the database and storage, and encrypt the keys it stores. This page lists them, explains how Areca stores the keys you enter in the interface, and gives the rotation steps for each secret.

Keep every real secret out of Git. Only the .env.example files are tracked, and they contain placeholders. Keep real values in your host's environment, a secrets manager, or a git-ignored .env file.

Secrets you provideCopy Anchor Link

These are set on the server as environment variables. See configuration for the full list.

Generate values like this:

openssl rand -hex 32        # BETTER_AUTH_SECRET
openssl rand -base64 32     # DOKPLOY_CREDENTIALS_ENCRYPTION_KEY, CLOUDFLARE_CREDENTIALS_ENCRYPTION_KEY and AI_SETTINGS_ENCRYPTION_KEY

The encryption keys must be base64 encodings of exactly 32 bytes. Areca refuses to start if a key that is set has a value in any other form.

Keys stored in the interfaceCopy Anchor Link

Some keys are entered in the interface rather than in the server environment:

• Dokploy API keys, one per client, entered in the client's deployment settings. Only agency admins can enter them.
• Cloudflare API tokens, one per client, entered on the client's Cloudflare card with the Account ID. Only agency admins can enter them.
• OpenRouter API key, entered on the AI page. Only agency admins can enter it. See AI data handling.

Areca encrypts each of these before it is saved:

• Algorithm. AES-256-GCM, an authenticated encryption method. Areca changes the random 12-byte starting value for every save, and any change to the stored ciphertext is detected when it is read.
• Binding. Each value is bound to where it is stored. A Dokploy key cannot be decrypted as an AI key, and a client's Dokploy key cannot be moved to another client. A Cloudflare token is bound to its client in the same way.
• Key. The encryption key comes from the server environment, not from the database. An attacker who gets only a database copy cannot decrypt the stored keys.

The interface never shows a saved key again. It shows only whether one is saved.

Site tokens and preview secretsCopy Anchor Link

Site tokens are not encrypted; they are stored as SHA-256 hashes, so there is nothing to decrypt. See tokens.

Each site also has a preview signing secret, created with the site. It is stored in the database without encryption and is never shown in the interface. It signs preview links. Areca has no way to change it, so anyone who can read the database can create valid preview links for that site's drafts, each valid for one hour. Protect database access accordingly.

Rotating secretsCopy Anchor Link

Rotate a secret when someone who knew it leaves, when it may have leaked, or on your own schedule. Use a maintenance window for the first two items in this list, because they end sessions or change stored data.

BETTER_AUTH_SECRETCopy Anchor Link

DOKPLOY_CREDENTIALS_ENCRYPTION_KEYCopy Anchor Link

Areca has no tool that re-encrypts stored Dokploy keys, and it cannot read them with an old key. Changing the key makes every saved Dokploy key unreadable.

1. Set the new key and restart the CMS.
2. In each client's deployment settings, enter the Dokploy API key again.
3. Create a new Dokploy API key in Dokploy for each client, and revoke the old one.

Do not change this key during an upgrade or a restore. See backup and recovery.

CLOUDFLARE_CREDENTIALS_ENCRYPTION_KEYCopy Anchor Link

As with the Dokploy key, there is no tool that re-encrypts stored Cloudflare tokens. Changing the key makes every saved Cloudflare token unreadable.

1. Set the new key and restart the CMS.
2. In each client's Cloudflare card, enter the API token again, with the Account ID, and select Save and verify.
3. Create a new user API token in Cloudflare for each client, and revoke the old one.

Do not change this key during an upgrade or a restore. See backup and recovery.

AI_SETTINGS_ENCRYPTION_KEYCopy Anchor Link

Changing the key makes the saved OpenRouter key unreadable. Until you enter the key again, AI generation reports that AI is not set up, and editors still see the AI actions.

To change it: set the new value, restart, then open AI and enter the OpenRouter key again. You cannot save a new key until this variable is set.

Storage, database, email and sign-in secretsCopy Anchor Link

Rotate these at the service that issues them, then update the CMS environment and restart:

• Database and Redis passwords, after changing them on the service.
• Storage access keys. You can rotate them without touching the stored Library files.
• Sign-in provider client secrets.

Site tokens and other tokensCopy Anchor Link

Rotate site and schema-write tokens on each site's Developer tab. To change METRICS_TOKEN or SETUP_TOKEN, set the new value and restart the CMS. See tokens.

Backups and exportsCopy Anchor Link

Backups and exports contain sensitive data. Treat them like the live system.

• Full instance backup. The Docker backup command, described in backup and recovery, saves the database, all Library files, and the environment file. The environment file holds BETTER_AUTH_SECRET, both encryption keys, and the storage and database credentials. Store the archive encrypted, on a separate host, with restricted access.
• Client export. An export made with the command described in backup and recovery contains the client's content, history, Library files, memberships, invitations, activity log, site records, and the client's Dokploy keys. The site records include each site's preview signing secret. The export does not contain passwords or sessions, but memberships, invitations and the activity log refer to users by email address. It does not contain the client's Cloudflare tokens.
• Not part of a client export. The OpenRouter key and AI settings belong to the whole instance, so they are not in a client export.

After you import a client into another instance, its sites start in demo mode, have no deployment target, and need new site tokens. Rotate the site and schema-write tokens on each site when you reconnect its project. Enter the client's Cloudflare token again on its Cloudflare card, because Cloudflare tokens are not exported.

RelatedCopy Anchor Link

• Tokens
• Two-factor authentication and step-up
• Configuration
• Backup and recovery