Two secret systems, two different jobs.

The platform secret store protects deployment-level credentials: database passwords, cache and storage access, provider API keys, and the platform signing key. They live encrypted in the repository, are decrypted only on the production host, and are rendered into the runtime environment before containers start.

That system is intentionally operator-owned. It is about deployment integrity and the safe removal of raw secrets from plain environment files.

Tenant secrets are a different animal: webhook credentials, API request node tokens, tenant-specific provider values, and placeholders such as `{{secret:billing_key}}` used inside tools. They belong to a tenant, are managed through the product, and must travel with snapshots, exports, redaction, and restore flows.

Moving those values into the platform secret store would make the operator the editor for every customer integration. That is the wrong ownership boundary.

The tenant application layer uses placeholder references such as `{{secret:key_name}}`. The important part is not the braces. It is the resolver contract: which scope is allowed to read the secret, how missing values fail, how values are masked in exports, and how package snapshots avoid cleartext leakage.

This is why we centralized tenant secret resolution instead of letting every node invent its own templating behavior. One contract means one place to test isolation, redaction, and rotation.

Authorization: Bearer {{secret:hubspot_private_app_token}}
X-Billing-Key: {{secret:billing_key}}

Platform secrets are backed up as encrypted operational material. Tenant secrets need application-aware behavior: never show cleartext in package exports, preserve references through snapshots, allow redaction in audit views, and keep restore behavior predictable.

That split feels bureaucratic until the first restore. Then it becomes the difference between a clean tenant recovery and a production operator manually reconstructing somebody's webhook credentials from memory.