2.5 Account Secrets

Embed secrets for on-premise installations

Only relevant for software where end users are able to see the source code which contains the JWT secret.

In on-premise software installations where users can access the source code, having secrets directly in the source code poses a security risk. For instance, if a user can view the code, they can extract the secret and potentially compromise the system by creating valid JWT tokens for other users, accessing data, and more.

With account secrets you can add a unique secret for each end account, tied to specific account ids. When a new account is added on the customer side, we generate a new secret for that account, associated with the account ID (Account Foo, Account Bar in the example below)

For cloud installations of the same sofware, the default secret token of the embed can be used.