--- title: Introducing Secrets for Traffic Policy | daily.dev description: Ngrok has launched a developer preview of Secrets for Traffic Policy, letting users store sensitive values like passwords and API keys in encrypted vaults... canonical: https://daily.dev/posts/introducing-secrets-for-traffic-policy-pyiyskck5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Secrets for Traffic Policy | daily.dev og:description: Ngrok has launched a developer preview of Secrets for Traffic Policy, letting users store sensitive values like passwords and API keys in encrypted vaults... og:url: https://daily.dev/posts/introducing-secrets-for-traffic-policy-pyiyskck5 og:image: https://api.daily.dev/og/posts/pyIYskCk5.png og:image:alt: Introducing Secrets for Traffic Policy og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Secrets for Traffic Policy **[ngrok Blog](https://daily.dev/sources/ngrok)** · 3 min read · 0 upvotes · 0 comments ## Summary Ngrok has launched a developer preview of Secrets for Traffic Policy, letting users store sensitive values like passwords and API keys in encrypted vaults instead of hardcoding them into Traffic Policy YAML. Secrets are referenced dynamically via the secrets.get() macro, encrypted at rest with AES-256, and evaluated at runtime without being persisted in policy documents or logs. Updating a secret in the vault automatically propagates to every policy referencing it. The preview currently has limitations: API-only configuration (no dashboard UI), potential cleartext exposure in Traffic Inspector under full capture mode, and support restricted to a specific subset of Traffic Policy fields such as set-vars, verify-webhook, basic-auth, restrict-ips, and jwt-validation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I avoid hardcoding API keys and passwords in ngrok Traffic Policy YAML? Use ngrok's Secrets for Traffic Policy feature, currently in developer preview, which stores sensitive values in encrypted vaults and references them via the secrets.get() macro instead of embedding them in cleartext. Secrets are encrypted at rest with AES-256 and in transit with HTTPS plus TLS 1.2, and are evaluated at runtime without being persisted in policy documents or logs. _Track new secrets management features for API gateway configs like ngrok's on daily.dev._ ### What are the current limitations of ngrok's Secrets for Traffic Policy developer preview? Secrets can only be configured via API, with no dashboard UI available yet. Secrets interpolated into actions like add-headers may appear in cleartext in Traffic Inspector if full capture mode is enabled. Support is also limited to specific fields, including set-vars vars, verify-webhook secret, basic-auth credentials, restrict-ips allow/deny lists, and select jwt-validation fields. _Developers evaluating early-access API gateway features can follow rollout updates on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#encryption](https://daily.dev/tags/encryption), [#api-gateway](https://daily.dev/tags/api-gateway), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/introducing-secrets-for-traffic-policy-pyiyskck5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Secrets for Traffic Policy","url":"https://daily.dev/posts/introducing-secrets-for-traffic-policy-pyiyskck5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-secrets-for-traffic-policy-pyiyskck5"},"datePublished":"2026-08-23T07:21:03.159Z","dateModified":"2026-08-23T07:26:15.822Z","description":"Ngrok has launched a developer preview of Secrets for Traffic Policy, letting users store sensitive values like passwords and API keys in encrypted vaults...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d3ed9e6811d5659ed37436c184268450?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d3ed9e6811d5659ed37436c184268450?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-secrets-for-traffic-policy-pyiyskck5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,encryption,api-gateway,secrets-management","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Introducing Secrets for Traffic Policy"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-secrets-for-traffic-policy-pyiyskck5#faq","mainEntity":[{"@type":"Question","name":"How do I avoid hardcoding API keys and passwords in ngrok Traffic Policy YAML?","acceptedAnswer":{"@type":"Answer","text":"Use ngrok's Secrets for Traffic Policy feature, currently in developer preview, which stores sensitive values in encrypted vaults and references them via the secrets.get() macro instead of embedding them in cleartext. Secrets are encrypted at rest with AES-256 and in transit with HTTPS plus TLS 1.2, and are evaluated at runtime without being persisted in policy documents or logs. Track new secrets management features for API gateway configs like ngrok's on daily.dev."}},{"@type":"Question","name":"What are the current limitations of ngrok's Secrets for Traffic Policy developer preview?","acceptedAnswer":{"@type":"Answer","text":"Secrets can only be configured via API, with no dashboard UI available yet. Secrets interpolated into actions like add-headers may appear in cleartext in Traffic Inspector if full capture mode is enabled. Support is also limited to specific fields, including set-vars vars, verify-webhook secret, basic-auth credentials, restrict-ips allow/deny lists, and select jwt-validation fields. Developers evaluating early-access API gateway features can follow rollout updates on daily.dev."}}]} ```