---
title: "Order Lab secrets"
description: "How buyers and integrators set owner_private and public_shared env keys on ?tab=secrets — encryption, allowlist, and apply-on-deploy."
locale: "en"
---
# Order Lab secrets

> **Info**
> Desk URL pattern: `/admin/crm/orders/[id]?tab=secrets` (admin) · `/my-orders/[id]?tab=secrets` (buyer). Same panel component: `OwnerSecretsPanel`.

The **Secrets** tab is the buyer-facing form for clone credentials that are **not** brand overlay fields. Values load masked; secrets save encrypted; public values store plaintext. Changes apply on the **next deploy**.

### For founders

## How to fill Secrets

Open your order → **Secrets**. Use the outline buttons for guided docs (Firebase, Ring Filebase, WalletConnect, configuration hub).

Paste values from your provider consoles. Required owner keys show as tab status errors until set.

Click **Save**. Ask your integrator to deploy when ready — the panel reports `appliedOnNextDeploy`.

### Guides linked from the panel

| Service | Doc |
|---------|-----|
| Firebase Admin + client | [Firebase backend](/docs/backend/firebase.md) |
| Object storage | [Ring Filebase](/docs/integrations/ring-filebase.md) |
| Mobile wallets | [WalletConnect Project ID](/docs/configuration/walletconnect.md) |
| Full catalog | [Supported services](/docs/configuration/supported-services.md) |

> **Tip**
> Integrator-only keys (database passwords, `AUTH_SECRET`, WayForPay merchant secret) appear on the integrator **Env** tab — not on buyer Secrets. If something is missing, ask your integrator to **Request update** from the room.

### For developers

## Save flow (verified)

```text
GET  /api/my-orders/[id]/env  → masked envConfig + owner-filtered groups
PATCH /api/my-orders/[id]/env → assertEnvPatchAllowed(role) → saveEnvConfig
```

- Allowlist = keys present in cwd `env.local.template` (parsed by `parseEnvTemplate`).
- Buyer role: `owner_private` + `public_shared` only (`canRoleWriteEnvKey`).
- Secret class values encrypted in deployment store; public class plaintext.
- UI: `features/crm/orders/owner-secrets-panel.tsx`.

### Typical owner_private keys

Firebase Admin (`AUTH_FIREBASE_*`, `FIREBASE_*`), client Firebase (`NEXT_PUBLIC_FIREBASE_*`), RingBase token (`RINGBASE_API_TOKEN`), SMTP/IMAP for Ring Mailer / Email CRM.

## Related documentation

  
- [configuration/public-vars](/docs/configuration/public-vars.md) — Same-workflow: which NEXT_PUBLIC_* keys buyers own.

  
- [configuration/supported-services](/docs/configuration/supported-services.md) — Next-step: provider consoles for each secret family.

  
- [features/owner-project-lab](/docs/features/owner-project-lab.md) — Prerequisite: Order Lab roles and tabs.

  
- [features/ring-mailer](/docs/features/ring-mailer.md) — See-also: SMTP owner keys for Ring Mailer / RingdomX.