Secret Management Configuration

The SecretManagement section configures how Synentra resolves sensitive configuration values such as API keys, connection strings, JWT signing keys, and other secrets.

Instead of storing secrets directly in appsettings.json, Synentra can retrieve them from external secret providers. The active provider is selected through the DefaultProvider property.

Properties

Property	Type	Default	Description
`DefaultProvider`	`SecretManagementProviderType`	`None`	Secret provider used by Synentra. Supported values: `None`, `EnvironmentVariables`, `AzureKeyVault`, and `UserSecrets`.
`Providers.EnvironmentVariables.Prefix`	`string?`	—	Optional prefix applied to environment variable names when resolving secrets.
`Providers.AzureKeyVault.VaultUri`	`string?`	—	Azure Key Vault URI (for example `https://my-vault.vault.azure.net/`).
`Providers.AzureKeyVault.Optional`	`bool`	`false`	If `true`, Synentra continues startup when the Key Vault cannot be reached.
`Providers.AzureKeyVault.SecretPrefix`	`string?`	—	Optional prefix added to all secret names when querying Azure Key Vault.
`Providers.AzureKeyVault.ReloadOnChange`	`bool`	`false`	Automatically reload secrets when the configured interval elapses.
`Providers.AzureKeyVault.ReloadInterval`	`TimeSpan`	`00:30:00`	Interval between secret refresh operations when `ReloadOnChange` is enabled.

Provider Types

None (Default)

No external secret provider is used.

Secrets are read directly from the normal .NET configuration pipeline (such as appsettings.json, environment variables, command-line arguments, etc.).

{
  "SecretManagement": {
    "DefaultProvider": "None"
  }
}

Environment Variables

Resolves secrets from operating system environment variables.

This provider is particularly useful for:

Docker containers
Kubernetes
CI/CD pipelines
Cloud deployments

Optionally, a prefix can be specified so only variables beginning with that prefix are considered.

{
  "SecretManagement": {
    "DefaultProvider": "EnvironmentVariables",
    "Providers": {
      "EnvironmentVariables": {
        "Prefix": "SYNENTRA_"
      }
    }
  }
}

Example environment variables:

SYNENTRA_AgentAuth__TokenIssuance__Secret=super-secret-key
SYNENTRA_System__Storage__ConnectionString=Server=...

If no prefix is configured, all environment variables are available through the standard .NET configuration system.

Azure Key Vault

Retrieves secrets from Azure Key Vault using the Azure SDK.

Synentra authenticates using DefaultAzureCredential, allowing the same configuration to work across multiple environments:

Azure Managed Identity
Service Principal
Azure CLI (az login)
Visual Studio
Visual Studio Code

{
  "SecretManagement": {
    "DefaultProvider": "AzureKeyVault",
    "Providers": {
      "AzureKeyVault": {
        "VaultUri": "https://my-vault.vault.azure.net/"
      }
    }
  }
}

Optional Key Vault

If Optional is enabled, Synentra will continue starting even if the Key Vault is unavailable.

{
  "SecretManagement": {
    "DefaultProvider": "AzureKeyVault",
    "Providers": {
      "AzureKeyVault": {
        "VaultUri": "https://my-vault.vault.azure.net/",
        "Optional": true
      }
    }
  }
}

Secret Prefix

When multiple applications share the same Key Vault, a prefix can be applied to all secret names.

{
  "SecretManagement": {
    "DefaultProvider": "AzureKeyVault",
    "Providers": {
      "AzureKeyVault": {
        "VaultUri": "https://my-vault.vault.azure.net/",
        "SecretPrefix": "synentra-"
      }
    }
  }
}

For example:

Requested configuration key	Key Vault secret
`JwtSecret`	`synentra-JwtSecret`
`DatabaseConnection`	`synentra-DatabaseConnection`

Automatic Secret Reload

Azure Key Vault secrets can be refreshed automatically without restarting Synentra.

{
  "SecretManagement": {
    "DefaultProvider": "AzureKeyVault",
    "Providers": {
      "AzureKeyVault": {
        "VaultUri": "https://my-vault.vault.azure.net/",
        "ReloadOnChange": true,
        "ReloadInterval": "00:10:00"
      }
    }
  }
}

When enabled, Synentra periodically checks Azure Key Vault for updated secret values using the configured interval.

User Secrets

UserSecrets is intended for local development.

When selected, Synentra uses the .NET User Secrets configuration provider, allowing developers to store secrets outside the project without committing them to source control.

{
  "SecretManagement": {
    "DefaultProvider": "UserSecrets"
  }
}

This provider is recommended only for development environments.

Configuration Example

{
  "SecretManagement": {
    "DefaultProvider": "AzureKeyVault",
    "Providers": {
      "EnvironmentVariables": {
        "Prefix": "SYNENTRA_"
      },
      "AzureKeyVault": {
        "VaultUri": "https://my-vault.vault.azure.net/",
        "Optional": false,
        "SecretPrefix": "synentra-",
        "ReloadOnChange": true,
        "ReloadInterval": "00:30:00"
      }
    }
  }
}

Provider Selection

Provider	Typical Usage
`None`	Secrets provided directly through the normal .NET configuration pipeline.
`EnvironmentVariables`	Containers, Kubernetes, cloud deployments, CI/CD pipelines.
`AzureKeyVault`	Production Azure deployments requiring centralized secret management.
`UserSecrets`	Local development without storing secrets in configuration files.

Recommendations

Use User Secrets during local development.
Use Environment Variables for containerised deployments.
Use Azure Key Vault for production environments running in Azure.
Avoid storing secrets directly in appsettings.json.
Enable ReloadOnChange only if your deployment requires runtime secret rotation.

Properties​

Provider Types​

None (Default)​

Environment Variables​

Azure Key Vault​

Optional Key Vault​

Secret Prefix​

Automatic Secret Reload​

User Secrets​

Configuration Example​

Provider Selection​

Recommendations​