> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://docs.ampdb.io/api/mcp` to find what you need.

# Secrets in Config Maps

Status: Unstable.

[Config maps](/managing-amp/config-maps) often configure things that need a credential, like an RPC endpoint's token or
a database password. Never write the credential itself into a config map. Write a reference to an environment variable
instead:

```toml
auth_token = "${{ env.MAINNET_RPC_TOKEN }}"
```

Amp doesn't enforce this: it accepts, stores, and returns a credential written in plain text, without a warning. This
page explains what that costs, what Amp does guarantee, and the one mistake that leaks a credential quietly.

## Prerequisites

* A config map document to write, in TOML or JSON. See [Config Map Format](/managing-amp/config-maps/format).

## Use a reference

Write each secret field as a `${{ env.NAME }}` reference:

```toml [mainnet_rpc.toml]
kind = "evm-rpc"
network = "mainnet"
url = "https://ethereum-rpc.example.com"
auth_token = "${{ env.MAINNET_RPC_TOKEN }}"
```

```bash
ampctl configmap create mainnet_rpc --namespace acme --from-file ./mainnet_rpc.toml
```

Amp stores the text `${{ env.MAINNET_RPC_TOKEN }}`, not the token. In this release, no part of Amp loads config maps,
so nothing fills the reference in yet.

Which fields hold secrets depends on the config map's kind: a token, a password, a private key, or a URL with a
credential in it. Amp can't tell them apart from other strings, so it's up to you to reference every one of them.

## The `${VAR}` trap

[Provider configurations](/providers/configuration-reference) write environment variables as `${VAR}`. In a config map,
that's not a reference: `${VAR}` is plain text, stored and returned as it is, with no error and no warning.

```toml
# Wrong: stored and used as the literal text ${MAINNET_RPC_TOKEN}
auth_token = "${MAINNET_RPC_TOKEN}"

# Right
auth_token = "${{ env.MAINNET_RPC_TOKEN }}"
```

## What a stored credential costs

This request succeeds, and nothing warns you:

```toml
# Wrong: the credential is stored, and returned by every read
auth_token = "sk_live_actual_credential_value"
```

Once stored, the credential:

* **Is readable by anyone who can read the namespace.** Inspecting the config map returns its document exactly as
  stored, with nothing hidden. That may be more people than the credential's owner expects.
* **Is in the metadata database's backups.**
* **Stays leaked after you delete the config map.** Deleting it doesn't remove it from backups or from anyone who read
  it. Rotating the credential is the only fix.

## What Amp guarantees

Amp never writes a config map's document into its logs, metrics, traces, error messages, or any other telemetry, in any
form: as you sent it, or as stored.

This guarantee covers what Amp writes, not what it returns: the Admin API still returns a stored credential to anyone
who can read the namespace.

## Limitations

* Nothing detects a credential stored in plain text, and nothing hides one.
* Reads are granted per namespace, so everyone who can read the namespace can read every credential stored in it.