Google Secret Manager is the production source for provider tokens and other sensitive runtime configuration. Local development uses ignored environment files.
How Harmonia uses it
Infrastructure enables the Secret Manager API, grants each runtime service account access only to required named secrets, and injects them into Cloud Run as environment variables. Examples include internal service authentication, Telegram credentials, X credentials, OAuth secrets, and upload-scanner authorization.
Security and authority
Secrets stay server-side and are excluded from Git, browser responses, prompts, Memory Bank, traces, logs, replay bundles, and public evidence. Access to a credential does not authorize an effect; approval and policy still bind the exact action.
Failure behavior
Missing required secrets fail configuration or provider calls visibly. Harmonia does not substitute placeholder credentials or mark an unauthenticated integration as connected.
Evidence status
Configuration validation and deployment wiring are repository-verified. Production secret use requires redacted configuration and IAM evidence; secret values themselves must never be captured.
Relevant files
src/lib/config.tsagent/harmonia_agent/config.pyinfra/setup.shinfra/deploy.shdocs/configuration.mdx
Last modified on August 28, 2026
