# Library properties and secrets

Source: https://govform.com/resources/documentation/article/20-12-library-properties-and-secrets
Topic: Library Settings

Properties and secrets are named library values with separate QA, Staging and Production values where those environments are available. Services use the same name and receive the value for their environment.

## Choose the correct value type

| Type | Use | Display |
| --- | --- | --- |
| Property | Non-sensitive URLs, public account identifiers, settings JSON and feature flags. | Visible to authorised builders. |
| Secret | Passwords, API keys, signing keys and other credentials. | Encrypted; saved values are never displayed back in the editor. |

Open **Library settings → Properties** or **Secrets**. Only library administrators can change values. Choose stable names such as `ordersBaseUrl` and `ordersApiToken`; do not put an environment in the name.

## Understand keys and environments

Add, rename or delete IDs while QA is selected. The same IDs appear in the other environments with separate values; a new ID starts empty there. Switching the environment selector keeps your draft edits so you can fill in all environments before applying.

Renaming or deleting an ID can break every service that references it. Review dependent actions, payment settings and Liquid first. A library connection that manages OAuth consent has its own workflow; access and refresh tokens do not belong in these editors.

## Add and apply a property

1.  Open Properties and select QA.
2.  Add the ID and non-sensitive value.
3.  Select each other available environment and enter its appropriate value.
4.  Review all values, including Production, then select **Apply**.
5.  Check environment status and test the dependent services.

Apply saves this editor's values across environments and publishes the combined Properties and Secrets, including the other editor's saved values. It is not restricted to the environment currently displayed.

## Add and apply a secret

In Secrets, add the ID in QA, then use each environment's control:

| Choice | Effect |
| --- | --- |
| Keep saved value | Retains the existing secret without revealing it. |
| Set value / Replace value | Stores the credential you enter for this environment. |
| Clear value | Removes that environment's saved value. It does not revoke the credential at its provider. |

Review all environments and select Apply. Keep the original credential in your organisation's approved secret store. Do not put it in screenshots, chat, ordinary Properties, page content or logs. If the editor reports a newer save, refresh and review it before repeating your change.

## Reference values in Liquid

```
{{ library.properties.ordersBaseUrl }}
{{ library.secrets.ordersApiToken }}
```

Use references only where the destination needs them, such as an API authentication header. Never render a secret into applicant content or diagnostic output. Registered secrets have application-log masking subject to the deployment policy; very short values may be excluded, and masking does not make arbitrary output safe.

## Reuse values from payment and connector settings

Where supported, administrators can create or select named Properties and Secrets from payment or Connector settings. **Where these details are saved** shows the shared references. A saved secret shows its status, not its value. Editing a shared entry can affect every service using its name.

## Rotate a value without breaking services

Review the provider's rotation process and all dependent services. For payment account changes, create new named entries and keep the old entries until outstanding payments are resolved; do not overwrite credentials needed by an earlier attempt. For other integrations, test replacement values and coordinate their all-environment Apply before revoking old credentials.

## Troubleshoot an unchanged or missing value

Check spelling/case, the selected environment's value, delivery status, service overrides and the external account's permissions. A successful Apply is not evidence that the provider accepted a request. Test in deployed QA and inspect the action result without printing the secret.

See [Shared settings publication](<https://govform.com/resources/documentation/article/20-15-library-settings-publication>), [Library connections](<https://govform.com/resources/documentation/article/20-16-library-connections>), [API actions](<https://govform.com/resources/documentation/article/25-08-action-api>) and [Payment settings](<https://govform.com/resources/documentation/article/service-payment-settings>).