Secrets

Slingshot resolves all secrets at startup. A server that boots successfully has all its secrets. A server that can’t find a required secret throws before accepting a single request.

What secrets the framework requires

The JWT signing key is the only always-required secret. Everything else depends on which packages and features you enable.

Always required

Secret	Used by	Notes
signing.secret	slingshot-auth	JWT signing. Minimum 32 characters. Rotate via key versioning.

Database credentials

Secret	Used when
DATABASE_URL	Postgres adapter is configured
MONGO_URL	MongoDB adapter is configured
REDIS_URL	Redis adapter is configured (sessions, cache, queues)

Auth features

Secret	Used when
GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET	Google OAuth is enabled
GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET	GitHub OAuth is enabled
APPLE_CLIENT_ID / APPLE_TEAM_ID / APPLE_KEY_ID / APPLE_PRIVATE_KEY	Apple Sign-In is enabled
SMTP_HOST / SMTP_USER / SMTP_PASS	Email delivery via SMTP

Platform packages

Secret	Package	Used when
SCIM_BEARER_TOKEN	slingshot-scim	SCIM provisioning is enabled
MEILI_API_KEY	slingshot-search	Meilisearch adapter
ES_API_KEY	slingshot-search	Elasticsearch adapter
TYPESENSE_API_KEY	slingshot-search	Typesense adapter

Infrastructure (slingshot-infra)

Secret	Used when
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY	Deploying to AWS (ECS, RDS, SSM)
CLOUDFLARE_API_TOKEN	DNS via Cloudflare
DOCKER_REGISTRY_TOKEN	Pushing to a private Docker registry

---

How to provide secrets

Environment variables (default)

Set them in your shell or deployment environment:

export SECRET=my-32-char-minimum-signing-secret
export DATABASE_URL=postgresql://user:pass@host/db

Read them directly inside app.config.ts:

app.config.ts (excerpt)

import { defineApp } from '@lastshotlabs/slingshot';

export default defineApp({
  security: { signing: { secret: process.env.SECRET! } },
  db: { postgres: process.env.DATABASE_URL },
});

.env file (development)

Use a .env file for local development by configuring the file-backed secrets provider on secrets:

app.config.ts (excerpt)

import { defineApp } from '@lastshotlabs/slingshot';

export default defineApp({
  secrets: {
    provider: 'file',
    path: `${import.meta.dir}/.env`,
  },
});

.env

SECRET=my-32-char-minimum-signing-secret
DATABASE_URL=postgresql://localhost/myapp
REDIS_URL=redis://localhost:6379

Caution

Never commit .env to source control. Add it to .gitignore.

AWS SSM Parameter Store (production)

Store production secrets in SSM:

app.config.ts (excerpt)

export default defineApp({
  secrets: {
    provider: 'ssm',
    pathPrefix: '/myapp/prod/',
    region: 'us-east-1',
  },
});

SSM parameters fetch at startup. /myapp/prod/SECRET resolves as SECRET, /myapp/prod/DATABASE_URL as DATABASE_URL, and so on.

Push secrets to SSM with the CLI:

slingshot secrets push --stage prod

Pull them back to a local .env:

slingshot secrets pull --stage prod

---

Checking what’s required

Validate all required secrets are present before deploying:

slingshot secrets check --stage prod

Reads your app.config.ts, determines which packages and features are enabled, and verifies that every required secret exists in the configured provider. Missing secrets are listed by name — no hunting through stack traces.

---

Signing secret rotation

JWT signing uses signing.secret to sign and verify tokens. Rotating the secret invalidates all existing sessions.

For zero-downtime rotation, configure a key version:

app.config.ts (excerpt)

export default defineApp({
  security: {
    signing: {
      secret: process.env.SECRET_V2!,
      previousSecrets: [process.env.SECRET_V1!],
    },
  },
});

Tokens signed with SECRET_V1 remain valid until they expire. New tokens sign with SECRET_V2. Once all V1 tokens have expired, remove previousSecrets.

---

Resolving secrets in app.config.ts

app.config.ts is a TypeScript module: read straight from process.env, or call out to the configured secrets store via the helpers exposed in @lastshotlabs/slingshot. Most apps just read process.env directly and let the secrets provider populate it from SSM / a file at boot.

app.config.ts (excerpt)

export default defineApp({
  security: {
    signing: { secret: process.env.SIGNING_SECRET! },
  },
  db: {
    postgres: process.env.DATABASE_URL,
    redis: process.env.REDIS_URL,
  },
});

---

See also

• Internals: Secrets — how the secrets pipeline works
• Deployment — pushing secrets to SSM as part of deploy
• Production Databases — database credential setup