> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ensync.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# App Secret

> Understanding appSecret credentials

## What is appSecret?

The **appSecret** is your app's private decryption key. It's used to decrypt events that are sent to your app. You receive it when you create an app.

## Usage

Pass the appSecret when creating your EnSync client:

<Tabs>
  <Tab title="Node.js">
    ```javascript theme={null}
    const client = await EnSyncClient.create({
      appKey: "ensk_prod_xxxxxxxxxxxxx",
      appSecret: "base64-encoded-private-key"
    });
    ```
  </Tab>

  <Tab title="Python">
    ```python theme={null}
    client = await EnSyncClient.create(
        app_key="ensk_prod_xxxxxxxxxxxxx",
        app_secret="base64-encoded-private-key"
    )
    ```
  </Tab>
</Tabs>

## How It Works

### Encryption Flow

1. **Publisher encrypts**: Event is encrypted with your appId
2. **EnSync delivers**: Encrypted event is sent to your app
3. **Your app decrypts**: SDK uses appSecret to decrypt the event

### Single Recipient (Asymmetric)

```
Publisher → Encrypt with recipient's appId → EnSync → Decrypt with appSecret
```

### Multiple Recipients (Hybrid)

```
Publisher → Encrypt message with AES key
         → Encrypt AES key with each recipient's appId
         → EnSync delivers
         → Each recipient decrypts AES key with their appSecret
         → Decrypt message with AES key
```

## Security

<Warning>
  **Keep your appSecret extremely secure!** Anyone with your appSecret can:

  * Decrypt all events sent to your app
  * Read sensitive data in event payloads
</Warning>

### Best Practices

* **Never commit to version control**: Use environment variables or secret managers
* **Never log or print**: Avoid exposing in logs or error messages
* **Rotate carefully**: Changing appSecret requires coordination with publishers
* **Store securely**: Use secret management services (AWS Secrets Manager, HashiCorp Vault, etc.)

```bash theme={null}
# ✅ Use environment variables
export ENSYNC_APP_SECRET="base64-encoded-key"

# ✅ Use secret managers
aws secretsmanager get-secret-value --secret-id ensync/app-secret

# ❌ Don't hardcode
const appSecret = "base64-key"; // Bad!

# ❌ Don't log
console.log("Secret:", appSecret); // Bad!
```

## appId vs appSecret

Your app has both a public and private key:

* **appId** (public key): Share with publishers so they can encrypt events for your app (safe to expose)
* **appSecret** (private key): Keep secret (never share)

## Rotating appSecret

To rotate your appSecret:

1. Create a new app with the same permissions (see [Create Access Key](/api-reference/endpoint/access-keys/create))
2. Update your app to use the new appKey and appSecret
3. Notify publishers of your new appId
4. Update service key pair if needed (see [Update Service Key Pair](/api-reference/endpoint/service-keys/update))
5. Deprecate the old key after transition period