Genesys Cloud - Developer Community!

 View Only

Sign Up

  • 1.  Archy credentials encryption

    Posted 2 days ago

    Hi,

    Please,

    Is it possible to encrypt   Archy credentials (clientId and secret) in  .archy_config  or  options file ?


    #Archy

    ------------------------------
    Leonel
    PS Consultant
    ------------------------------


  • 2.  RE: Archy credentials encryption

    Posted 2 days ago

    Hi Leonel,

    I checked the Archy documentation and the available Genesys examples again.

    Archy does not provide a documented mechanism to encrypt clientId or clientSecret inside .archy_config or an options file and then decrypt those values automatically at runtime.

    Both configuration methods expect the actual credential value.

    The better approach is to keep the OAuth secret outside the Archy configuration.

    Archy supports configuration overrides, including environment-based configuration, so for automation/CI-CD I would use a secret manager or the pipeline's protected secret store and expose the credential to the Archy process only at runtime.

    For example:

    Secret Manager / GitHub Secrets / Azure DevOps Secrets / Jenkins Credentials
    → environment variable
    → Archy execution

    This avoids storing the clientSecret in:

    • .archy_config
    • options YAML files
    • source control repositories

    The clientId itself is generally not sensitive in the same way as the clientSecret, but I would still manage both together in the deployment pipeline for consistency.

    I would also avoid passing the secret directly as a literal command-line argument where possible, because command-line arguments can be exposed through shell history, logs, or process inspection.

    So the recommended approach is:

    Do not encrypt the secret inside .archy_config. Store it in a proper secret store and inject it into Archy at runtime, preferably through environment-based configuration.

    There is currently no documented native encryption/decryption feature for Archy's .archy_config or options files.



    ------------------------------
    Gabriel
    NA
    ------------------------------



  • 3.  RE: Archy credentials encryption

    Posted yesterday

    I agree with Gabriel's answer that, as far as the current Archy implementation goes, there is no native mechanism to store an encrypted clientId or clientSecret in .archy_config and have Archy automatically decrypt it during execution.

    One additional consideration is that the objective should probably be avoiding persistent storage of secrets altogether, rather than encrypting them inside the configuration file.

    In CI/CD environments, I've had good results using one of these patterns:

    Option 1: Environment Variables (recommended)

    Azure Key Vault
    AWS Secrets Manager
    HashiCorp Vault
    GitHub Secrets
    Jenkins Credentials
    ↓
    Environment Variables
    ↓
    Archy Execution

    This ensures the secret never needs to be committed to source control or stored in .archy_config.

    Option 2: Generate .archy_config dynamically

    Instead of storing a permanent configuration file containing credentials, generate the file at runtime from pipeline variables and remove it immediately after the Archy operation completes.

    Retrieve Secret
    ↓
    Generate temporary .archy_config
    ↓
    Run Archy
    ↓
    Delete temporary file

    Option 3: Short-lived OAuth Clients

    For organizations with strict security requirements, consider using dedicated OAuth clients per environment (Dev/Test/Prod) with the minimum required permissions. This reduces the impact of a potential credential exposure and simplifies credential rotation.

    Another point worth mentioning is that encrypting a value inside a file only provides additional security if the decryption key is managed separately. If both the encrypted secret and the key are available to the same process, the practical security benefit is often limited. That's why secret-management platforms are usually preferred over application-level encrypted configuration files.

    So my recommendation would be:

    • ✅ Store secrets in a vault or CI/CD secret store.
    • ✅ Inject credentials only at runtime.
    • ✅ Keep .archy_config free of secrets whenever possible.
    • ✅ Use environment-specific OAuth clients and periodic secret rotation.
    • ❌ Avoid committing credentials (encrypted or plaintext) to source control.

    From a security and DevOps perspective, this is generally a stronger approach than adding encryption directly to .archy_config.

    Regards,



    ------------------------------
    Cesar
    INDRA COLOMBIA
    ------------------------------



Related Content