# Runtime secrets

`../../homelab-emergency init-secrets` creates these untracked files:

- `vault_master_key`: 32-byte base64 key used only to wrap per-credential data keys.
- `portal_gateway_hmac`: 32-byte base64 key used to authenticate Portal-to-Gateway requests.

Back up both outside this repository. Never store either key in `vault.db`, Authentik, Docker labels,
or the Portal UI.