Ionize Documentation What is Ionize Architecture Repo Map License Glossary

Dashboard API Authentication Dashboard API Errors Dashboard API Pagination Dashboard Settings API SDK Settings API

Environment variables

Secrets catalog ENCRYPTION_KEY SESSION_SIGNING_KEY CIAM_RELOAD_API_KEY IAM_RELOAD_API_KEY CIAM_KRATOS_COOKIE_SECRET IAM_KRATOS_COOKIE_SECRET CIAM_KRATOS_CIPHER_SECRET IAM_KRATOS_CIPHER_SECRET CIAM_HYDRA_SYSTEM_SECRET IAM_HYDRA_SYSTEM_SECRET SMTP_USER / SMTP_PASSWORD TURNSTILE_SECRET_KEY DATABASE_URL Postgres CA certificate DEPLOY_SSH_KEY GHCR pull token Deploy provider tokens

ReferenceSecrets

CIAM_KRATOS_CIPHER_SECRET

Kratos recovery/verification token cipher.

Secret: `CIAM_KRATOS_CIPHER_SECRET`

Purpose: Kratos recovery/verification token cipher.

Source: GitHub Secrets

Rotation runbook: /docs/operate/secrets-audit

How it's used

Loaded at container startup. Failure to read the secret usually causes a fatal startup error.

How to rotate

See the linked runbook above. Most secrets have a documented zero-downtime rotation procedure.

Related

Security — Secrets management — full inventory.
Operate — Secrets audit — quarterly cadence.

IAM_KRATOS_COOKIE_SECRET

Kratos IAM session cookie HMAC.

IAM_KRATOS_CIPHER_SECRET

Kratos IAM cipher.

On this page

Secret: CIAM_KRATOS_CIPHER_SECRETHow it's used How to rotate Related