[{"data":1,"prerenderedAt":250},["ShallowReactive",2],{"navigation":3,"\u002Fstation-runtime\u002Fcredentials-and-secrets":99,"\u002Fstation-runtime\u002Fcredentials-and-secrets-surround":245},[4,16,28,55,82],{"title":5,"path":6,"stem":7,"children":8,"icon":10},"Get started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,11],{"title":5,"path":6,"stem":7,"icon":10},"i-lucide-rocket",{"title":12,"path":13,"stem":14,"icon":15},"Your first station run","\u002Fgetting-started\u002Ffirst-run","1.getting-started\u002F2.first-run","i-lucide-play",{"title":17,"path":18,"stem":19,"children":20,"icon":22},"Core concepts","\u002Fcore-concepts","2.core-concepts\u002F1.index",[21,23],{"title":17,"path":18,"stem":19,"icon":22},"i-lucide-boxes",{"title":24,"path":25,"stem":26,"icon":27},"Projects and access","\u002Fcore-concepts\u002Fprojects-and-access","2.core-concepts\u002F2.projects-and-access","i-lucide-users",{"title":29,"path":30,"stem":31,"children":32,"icon":34},"Station runtime","\u002Fstation-runtime","3.station-runtime\u002F1.index",[33,35,40,45,50],{"title":29,"path":30,"stem":31,"icon":34},"i-lucide-circuit-board",{"title":36,"path":37,"stem":38,"icon":39},"Configure a station","\u002Fstation-runtime\u002Fconfiguration","3.station-runtime\u002F2.configuration","i-lucide-file-code-2",{"title":41,"path":42,"stem":43,"icon":44},"Custom stages","\u002Fstation-runtime\u002Fcustom-stages","3.station-runtime\u002F3.custom-stages","i-lucide-puzzle",{"title":46,"path":47,"stem":48,"icon":49},"Credentials and secrets","\u002Fstation-runtime\u002Fcredentials-and-secrets","3.station-runtime\u002F4.credentials-and-secrets","i-lucide-key-round",{"title":51,"path":52,"stem":53,"icon":54},"Multiple lanes","\u002Fstation-runtime\u002Fmultiple-lanes","3.station-runtime\u002F5.multiple-lanes","i-lucide-git-branch",{"title":56,"path":57,"stem":58,"children":59,"icon":61},"Production workflows","\u002Fproduction-workflows","4.production-workflows\u002F1.index",[60,62,67,72,77],{"title":56,"path":57,"stem":58,"icon":61},"i-lucide-factory",{"title":63,"path":64,"stem":65,"icon":66},"Applications and firmware","\u002Fproduction-workflows\u002Ffirmware-images","4.production-workflows\u002F2.firmware-images","i-lucide-cpu",{"title":68,"path":69,"stem":70,"icon":71},"DUT records and IDs","\u002Fproduction-workflows\u002Fdut-records-and-ids","4.production-workflows\u002F3.dut-records-and-ids","i-lucide-scan-barcode",{"title":73,"path":74,"stem":75,"icon":76},"Results and logs","\u002Fproduction-workflows\u002Fresults-and-logs","4.production-workflows\u002F4.results-and-logs","i-lucide-chart-no-axes-combined",{"title":78,"path":79,"stem":80,"icon":81},"Operator kiosk","\u002Fproduction-workflows\u002Foperator-kiosk","4.production-workflows\u002F5.operator-kiosk","i-lucide-monitor",{"title":83,"path":84,"stem":85,"children":86,"icon":88},"Reference","\u002Freference","5.reference\u002F1.index",[87,89,94],{"title":83,"path":84,"stem":85,"icon":88},"i-lucide-book-open",{"title":90,"path":91,"stem":92,"icon":93},"API access","\u002Freference\u002Fapi-access","5.reference\u002F2.api-access","i-lucide-braces",{"title":95,"path":96,"stem":97,"icon":98},"Troubleshooting","\u002Freference\u002Ftroubleshooting","5.reference\u002F3.troubleshooting","i-lucide-life-buoy",{"id":100,"title":46,"body":101,"description":238,"extension":239,"links":240,"meta":241,"navigation":242,"path":47,"seo":243,"stem":48,"__hash__":244},"docs\u002F3.station-runtime\u002F4.credentials-and-secrets.md",{"type":102,"value":103,"toc":234},"minimark",[104,108,138,145,185,192,197,200,204,207,221,227,230],[105,106,107],"p",{},"Each station gets its own MQTT username, MQTT password, and station API key when it is created. The provisioning values appear once. Store them in a protected environment file or secret manager on that jig.",[109,110,115],"pre",{"className":111,"code":112,"language":113,"meta":114,"style":114},"language-dotenv shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","HTF_MQTT_USERNAME=station-...\nHTF_MQTT_PASSWORD=st_mqtt_...\nHTF_API_KEY=st_api_...\n","dotenv","",[116,117,118,126,132],"code",{"__ignoreMap":114},[119,120,123],"span",{"class":121,"line":122},"line",1,[119,124,125],{},"HTF_MQTT_USERNAME=station-...\n",[119,127,129],{"class":121,"line":128},2,[119,130,131],{},"HTF_MQTT_PASSWORD=st_mqtt_...\n",[119,133,135],{"class":121,"line":134},3,[119,136,137],{},"HTF_API_KEY=st_api_...\n",[105,139,140,141,144],{},"The station also needs its organisation and station IDs and the endpoint values for the HTF deployment. The sample ",[116,142,143],{},".env.example"," lists the supported variables.",[105,146,147,148,152,153,156,157,160,161,164,165,168,169,172,173,164,176,179,180,184],{},"For the public production broker, the station also needs its own TLS client certificate and private key. Select ",[149,150,151],"strong",{},"Issue and download"," in the ",[149,154,155],{},"Station keys"," dialog during setup, or open ",[149,158,159],{},"Station settings"," later. The ZIP contains ",[116,162,163],{},"client.pem"," and ",[116,166,167],{},"client.key","; install them in a private directory outside the station repository. Set ",[116,170,171],{},"HTF_MQTT_TRANSPORT=mtls"," and point ",[116,174,175],{},"HTF_MQTT_CLIENT_CERT",[116,177,178],{},"HTF_MQTT_CLIENT_KEY"," at those files. See the ",[181,182,183],"a",{"href":13},"first-run walkthrough"," for the exact steps.",[105,186,187],{},[188,189],"img",{"alt":190,"src":191},"Station settings with TLS certificate controls","\u002Fimages\u002Fproduct\u002F13-station-certificates.png",[193,194,196],"h2",{"id":195},"rotate-a-credential","Rotate a credential",[105,198,199],{},"If a credential is exposed or a station connection may have been taken over, rotate it in the operator UI. Update that station's protected environment and restart it. Revoked values can no longer reconnect or call station APIs.",[193,201,203],{"id":202},"station-secrets","Station secrets",[105,205,206],{},"Operators with station management permission can save named station secrets in HTF. The station fetches them at startup or reconnect and holds them in memory for stages that need them. Changes are not hot reloaded; restart or reconnect after an edit. Custom stages can request a named value from their stage context.",[105,208,209,210,212,213,216,217,220],{},"Open a station and select ",[149,211,203],{},". Enter an uppercase name, its value, and select ",[149,214,215],{},"Save secret",". The UI shows the name later but does not reveal the value again. A custom stage reads it with ",[116,218,219],{},"context.require_secret(\"NAME\")",".",[105,222,223],{},[188,224],{"alt":225,"src":226},"Station secrets form","\u002Fimages\u002Fproduct\u002F12-station-secrets.png",[105,228,229],{},"Keep secret values out of YAML, stage output, logs, and command-line arguments. A secret name can appear in configuration; its value should remain in the secret store and the process that needs it.",[231,232,233],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":114,"searchDepth":122,"depth":128,"links":235},[236,237],{"id":195,"depth":128,"text":196},{"id":202,"depth":128,"text":203},"Provision each station independently and handle sensitive values safely.","md",null,{},{"icon":49},{"title":46,"description":238},"OCjzrFCQyCN8PqBKa6C14WwjbZg2LdKfSYz_BFLM52k",[246,248],{"title":41,"path":42,"stem":43,"description":247,"icon":44,"children":-1},"Extend a station with product-specific test logic.",{"title":51,"path":52,"stem":53,"description":249,"icon":54,"children":-1},"Run independent programmers on one jig and coordinate shared DUT steps.",1790376318215]