Skip to main content

​
Availability

Tyk AI Studio provides a secure mechanism for storing and managing sensitive information, such as API keys, passwords, authentication tokens, or other credentials required by various platform configurations.

​
Purpose

The Secrets Management system aims to:
  • Prevent Exposure: Avoid hardcoding sensitive values directly in configuration files or UI fields.
  • Centralize Management: Provide a single place to manage and update credentials.
  • Enhance Security: Store sensitive data encrypted at rest.

​
Core Concepts

  • Secret: A named key-value pair where the ‘key’ is the Variable Name used for reference, and the ‘value’ is the actual sensitive data (e.g., an API key string).
  • Encryption:
    • Secret values are encrypted at rest within Tyk AI Studio’s storage.
    • The encryption and decryption process relies on a key derived from the TYK_AI_SECRET_KEY environment variable set when running the Tyk AI Studio instance.
    • CRITICAL: The TYK_AI_SECRET_KEY must be kept confidential and managed securely. Loss of this key will render existing secrets unusable. Changing the key will require re-entering all secrets.
    • From v2.2.0, AI Studio encrypts each value with AES-256-GCM. It derives the key from TYK_AI_SECRET_KEY with scrypt and a random salt for each value. Encrypted values start with v2:.
    • On the first start of v2.2.0 or later, AI Studio encrypts existing values again in the background. Values in the old format stay readable during this process. If AI Studio cannot decrypt a value, it skips the value and logs a warning. It does not delete the value.
    • If TYK_AI_SECRET_KEY is not set, AI Studio stores secrets as plain text. It logs a SECURITY WARNING one time for each process. Always set TYK_AI_SECRET_KEY, also in test deployments that contain real credentials. Webhooks also use this key to encrypt their headers and signing secrets.
  • Reference Syntax: Secrets are referenced within configuration fields (like API key fields in LLM or Tool setups) using a specific syntax:
    Replace VariableName with the exact name given to the secret when it was created (e.g., $SECRET/OPENAI_API_KEY, $SECRET/JIRA_AUTH_TOKEN).
  • Runtime Resolution: When a configuration uses a field containing a secret reference (e.g., $SECRET/MY_KEY):
    1. The configuration itself stores the $SECRET/MY_KEY string, not the actual secret value.
    2. Only when the system needs the actual value at runtime (e.g., the Proxy preparing a request for an LLM, or a Tool calling its external API), Tyk AI Studio retrieves the encrypted secret value, decrypts it using the TYK_AI_SECRET_KEY, and injects the plain text value into the operation.
    3. The decrypted value is typically used immediately and not persisted further.

​
Creating & Managing Secrets (Admin)

Administrators manage secrets via the Tyk AI Studio UI or API:
  1. Navigate to Settings > Secrets in the admin UI sidebar.
  2. Create a new secret by providing:
    • Variable Name: A unique identifier (letters, numbers, underscores) used in the $SECRET/VariableName reference.
    • Secret Value: The actual sensitive string (e.g., sk-abc123xyz...).
  3. Save the secret. It is immediately encrypted and stored. Secrets UI
The secrets list shows if each secret has a value (Set or Empty), and the objects that use it (Used by). Before you delete a secret, AI Studio shows the objects that use it. Secrets can be updated or deleted as needed. Updating a secret value will automatically apply the new value wherever the $SECRET/VariableName reference is used, without needing to modify the configurations themselves.

​
Usage Examples

Secrets are commonly used in:
  • LLM Configurations: Storing API keys for providers like OpenAI, Anthropic, Google Vertex AI, etc.
    • Example: In the API Key field for an OpenAI configuration: $SECRET/OPENAI_API_KEY
  • Tool Configurations: Storing API keys, authentication tokens (Bearer, Basic Auth), or other credentials needed to interact with the external API the tool represents.
    • Example: In a field for a custom header for a JIRA tool: Authorization: Basic $SECRET/JIRA_BASIC_AUTH_TOKEN
  • Data Source Configurations: Storing API keys or connection credentials for vector databases (e.g., Pinecone, Milvus) or embedding service providers.
    • Example: In the API Key field for a Pinecone vector store: $SECRET/PINECONE_API_KEY

​
Security Considerations

  • Protect TYK_AI_SECRET_KEY: This is the master key for secrets. Treat it with the same level of security as database passwords or root credentials. Use environment variable management best practices.
  • Principle of Least Privilege: Grant administrative access (which includes secrets management) only to trusted users.
  • Regular Rotation: Consider policies for regularly rotating sensitive credentials by updating the Secret Value in Tyk AI Studio.