Generating custom secrets

If you want to generate custom secrets values, you can do this right from your console using a simple command.

You can use the openssl command (commonly available on many Unix-based systems) combined with tr and head commands. Here's how you can do it for each of your requirements:

# For UI_BAKERY_JWT_SECRET
openssl rand -base64 100 | tr -dc 'A-Z0-9' | head -c 42; echo
# For UI_BAKERY_JWT_SERVICE_ACCOUNT_SECRET
openssl rand -base64 100 | tr -dc 'A-Z0-9' | head -c 55; echo
# For UI_BAKERY_JWT_REFRESH_SECRET
openssl rand -base64 100 | tr -dc 'A-Z0-9' | head -c 42; echo
# For UI_BAKERY_CREDENTIALS_SECRET
openssl rand -base64 100 | tr -dc 'A-Z0-9' | head -c 32; echo
# For UI_BAKERY_MFA_SECRET
openssl rand -base64 100 | tr -dc 'A-Z0-9' | head -c 32; echo
# For UI_BAKERY_PROJECT_PRIVATE_KEY_SECRET
openssl rand -base64 100 | tr -dc 'A-Z0-9' | head -c 32; echo
# For UI_BAKERY_AUTH_DEVICE_INFO_SECRET
openssl rand -base64 100 | tr -dc 'A-Z0-9' | head -c 32; echo

Alternatively, you can also use urandom to generate secrets:

# For UI_BAKERY_JWT_SECRET
echo $(LC_ALL=C tr -cd "A-Za-z0-9" < /dev/urandom | head -c 42 | xargs -0)
# For UI_BAKERY_JWT_SERVICE_ACCOUNT_SECRET
echo $(LC_ALL=C tr -cd "A-Za-z0-9" < /dev/urandom | head -c 55 | xargs -0)
# For UI_BAKERY_JWT_REFRESH_SECRET
echo $(LC_ALL=C tr -cd "A-Za-z0-9" < /dev/urandom | head -c 42 | xargs -0)
# For UI_BAKERY_CREDENTIALS_SECRET
echo $(LC_ALL=C tr -cd "A-Za-z0-9" < /dev/urandom | head -c 32 | xargs -0)
# For UI_BAKERY_MFA_SECRET
echo $(LC_ALL=C tr -cd "A-Za-z0-9" < /dev/urandom | head -c 32 | xargs -0)
# For UI_BAKERY_PROJECT_PRIVATE_KEY_SECRET
echo $(LC_ALL=C tr -cd "A-Za-z0-9" < /dev/urandom | head -c 32 | xargs -0)
# For UI_BAKERY_AUTH_DEVICE_INFO_SECRET
echo $(LC_ALL=C tr -cd "A-Za-z0-9" < /dev/urandom | head -c 32 | xargs -0)

If your installation requires asymmetric JWT signing, you can use RSA key pairs instead. UI Bakery supports separate RSA key pairs for access tokens, refresh tokens, and service account tokens.

Generate the keys:

# For UI_BAKERY_JWT_ACCESS_PRIVATE_KEY
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt_access_private_key.pem
# For UI_BAKERY_JWT_ACCESS_PUBLIC_KEY
openssl rsa -pubout -in jwt_access_private_key.pem -out jwt_access_public_key.pem

# For UI_BAKERY_JWT_REFRESH_PRIVATE_KEY
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt_refresh_private_key.pem
# For UI_BAKERY_JWT_REFRESH_PUBLIC_KEY
openssl rsa -pubout -in jwt_refresh_private_key.pem -out jwt_refresh_public_key.pem

# For UI_BAKERY_JWT_SERVICE_ACCOUNT_PRIVATE_KEY
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt_service_account_private_key.pem
# For UI_BAKERY_JWT_SERVICE_ACCOUNT_PUBLIC_KEY
openssl rsa -pubout -in jwt_service_account_private_key.pem -out jwt_service_account_public_key.pem