Key File Configuration
Both encrypt and decrypt commands support an optional -key-file-path argument. This points to a .properties file that contains the active encryption key used by the Detect DetectPasswordManager.
Key File Location (on-premise)
Platform manages the keys and the location must be accessible by the CLI tool.
Key File Format
# Active encryption key used by DetectPasswordManager
key=08f195cd29f36a99b905193c....
When to Use a Custom Key File
| Scenario | Recommendation |
|---|---|
| Standard on-premise install with default setup | Omit -key-file-path; default key is used. |
| Custom or rotated encryption key in production | Always specify -key-file-path. |
| Encrypting values for a specific tenant/env | Use the key file specific to that environment. |
Important: Keep the key file secure. Anyone with access to the key file can decrypt all
values encrypted with it.