Hidden keys for this tenant
Every normal admin config page hides these values. This page is the one audited path to reveal a single one when you need to copy it. Values are fetched only when you press Reveal, shown for 60 seconds, and auto-hidden. Each reveal is logged with your login and the key name; the value itself is never written to any log.
[SECRETS-REVEAL] line to the trace log. Do not share this URL and do not screenshot the revealed value.
Wallet remote signing (CSC for EU wallets)
The settings an EU wallet app needs to offer this server as its signing service. The client secret goes into the wallet build; it is fetched only when you press Show for 60 seconds, and every reveal or rotation is recorded in the audit log with your login.
The secret is compiled into the wallet app and can be extracted from it, so the server treats this client like a public one: PKCE, the user’s own sign-in and the user’s confirmation of every signature protect each signing request. Holding the secret grants nothing beyond that. After a rotation, wallets built with the old secret can no longer sign until they are updated; sign-ins already completed stay valid until their access token expires (at most one hour).