> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useharmonia.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret Manager

> How Harmonia supplies provider credentials to Cloud Run without placing secrets in code or client bundles.

Google Secret Manager is the production source for provider tokens and other sensitive runtime configuration. Local development uses ignored environment files.

## How Harmonia uses it

Infrastructure enables the Secret Manager API, grants each runtime service account access only to required named secrets, and injects them into Cloud Run as environment variables. Examples include internal service authentication, Telegram credentials, X credentials, OAuth secrets, and upload-scanner authorization.

## Security and authority

Secrets stay server-side and are excluded from Git, browser responses, prompts, Memory Bank, traces, logs, replay bundles, and public evidence. Access to a credential does not authorize an effect; approval and policy still bind the exact action.

## Failure behavior

Missing required secrets fail configuration or provider calls visibly. Harmonia does not substitute placeholder credentials or mark an unauthenticated integration as connected.

## Evidence status

Configuration validation and deployment wiring are repository-verified. Production secret use requires redacted configuration and IAM evidence; secret values themselves must never be captured.

## Relevant files

* `src/lib/config.ts`
* `agent/harmonia_agent/config.py`
* `infra/setup.sh`
* `infra/deploy.sh`
* `docs/configuration.mdx`