APP_SECRET vs API_SECRET

[suncat100]

I can see talk about ENV variable APP_SECRET in many posts, yet it doesn’t seem to have any effect. Curiously, I tried out API_SECRET, and when assigned, this seems to be required in the “secret” input on login. Did anything change or are there typos going around? APP_SECRET doesn’t seem to be valid, yet it is mention in several posts 1, 2, [3] /t/still-some-issues-after-upgrade-to-v5/9345/5

[hillel]

Hi,

These are two separate values:

• APP_SECRET: used to limit updating the app
• API_SECRET: used to limit logging into the app

[suncat100]

Ahh, ok. But then surely the reference on the below link must be incorrect? It’s the first related search that comes up on Google when trying to find out how to assign “secret” on the login form.

Secret (Optional) field on login page

I am self-hosted. I am a little dense on this and have looked through the documentation and source but I cannot figure out the use of the “Secret (Optional)” field that is on the login page. I understand it is tied to the APP_KEY variable in .env but what is the use? If I put in my email/password/2fa, and put it random characters in the field I can still login? This also shows up on the iOS app. Super confused. Thanks.

[hillel]

Thanks, fixed

Note: I believe the two values are API_SECRET and UPDATE_SECRET