Skip to main content
All glossary terms

Credentials & security

Secret placeholder

A secret placeholder is a marker in a request or configuration that a trusted component recognizes and replaces with a stored credential. It allows a client to refer to a secret without containing its plaintext value, but only works when the request reaches a component configured to perform that substitution.

Also known as credential placeholder.

Why it matters in practice

Placeholders need an unambiguous syntax, permitted destination, and matching secret binding. For HTTPS requests, substitution inside an encrypted request requires the proxy to inspect the TLS connection; an opaque tunnel does not reveal the application header or body. A placeholder is not itself a credential or encryption mechanism.

Example

A test client sends Authorization: Bearer {$SECRET_NAME} to api.example.com; the proxy resolves the marker to its bound secret without putting a live key in client code.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.