Settings and secrets
The kinds of field an app can ask for, and why anything sensitive belongs in a secret rather than a setting.
An app declares what it needs and the dashboard renders a form from it. That is why setup is a few fields rather than a configuration file.
The kinds of field
| Type | What it is |
|---|---|
| Text | A single line |
| Text area | Several lines |
| Number | A numeric value |
| URL | A link, validated as one |
| Yes or no | A toggle |
| Select | A list of choices |
| Date and time | A picker |
| Image | An upload, for a logo or a background |
| Secret | A sensitive value, write-only once saved |
The image field matters more than it sounds. An app that needs a logo used to require hosting the file somewhere and pasting a URL; now it takes an upload.
Some apps also expose fields backed by a connected service, which become dropdowns of your own dashboards or calendars rather than fields you fill in by hand. See Connected services.
Settings that appear when they apply
An app can show a setting only when your other choices make it relevant, and put its settings in a deliberate order, with the decisions you make first at the top. Choose a mode, and the settings for other modes stay out of the form.
Each app's author adopts this, so you see it on some apps and not others. To build it into your own app, see Build and deploy.
Secrets
A secret is for anything that should not be readable afterwards: an API token, a password, a private URL.
Store credentials as secrets rather than settings. An ordinary setting is visible to anyone with access to the workspace, and a secret is not, including to administrators.
How a secret is protected
It is encrypted as soon as you save it, and never stored in plain text.
It reaches the device still encrypted, and only the device that owns that app instance can decrypt it. The decryption key never leaves the device.
On a Player Max, decryption uses the device's Trusted Platform Module: a dedicated chip holding the key in hardware, bound to that physical device and not extractable even with direct access to its storage. On other hardware, it uses a device-specific certificate on disk, so a secret encrypted for one device cannot be decrypted on another.
Write-only
[!IMPORTANT] Once saved, a secret cannot be read back, through the dashboard or the API. You can overwrite it; you cannot retrieve it. If you lose the value, regenerate the credential in the service it belongs to and save the new one.
Apps are isolated from each other
Each app runs in a sandbox and cannot read the files, settings, or secrets of another app on the same device. One compromised app has no path to another's data.
Where an app is rendered on our infrastructure rather than on the device, isolation is stricter still: it has no access to the device's local network or filesystem at all. See Where an app runs.