Client Secrets

Stop CI/CD pipelines breaking on expired tokens.

Non-interactive authentication for any pipeline. Set IPM_CLIENT_SECRETS once — the IPM CLI handles the rest, on every platform, every run.

Create a Secret Read the Docs →

zsh — azure devops pipeline

➜ app export IPM_CLIENT_SECRETS="$IPM_SECRET" ➜ app ipm add --package platform/secure-stack --non-interactive IPMHub Cli v0.14.0 Adding package platform/secure-stack to the workspace... Package 🛡 platform/secure-stack version 2.0.0 was added to the workspace and is synchronized.

Interactive prompts in CI/CD

Supported platforms

RBAC

Viewer & Contributor roles

Minutes

To set up per pipeline

The CI/CD auth problem

Authentication should never be the reason a deployment fails.

A pipeline can't complete an interactive login. So teams borrow an engineer's account — and end up with personal credentials in CI, too much access, and a different workaround on every platform.

Personal credentials in pipelines — they leave when people do

A pipeline tied to one engineer's identity breaks the day they change roles or leave. And the audit trail shows a person, not a pipeline.

Too much access — a deploy job doesn't need publish rights

A borrowed user account carries everything that user can do. Overprivileged pipeline credentials are a security audit finding waiting to happen.

Every CI platform needs a different auth approach

Azure DevOps, GitHub Actions, Jenkins, GitLab CI — each platform has its own auth quirks. No standard pattern to follow.

Setting up client secrets

Three steps to zero-prompt
pipeline authentication.

01 — Create

Generate a client secret in the IPMHub portal

Go to your organization settings and create a new client secret. Choose the role that matches what your pipeline needs — Viewer to download packages, Contributor to publish them.

# Portal: Organizations → Settings → Client Secrets # Choose role → Generate → Copy values ✓ Client secret created IPM_CLIENT_ID: abc-123 IPM_CLIENT_SECRET: ***

02 — Configure

Add as pipeline environment variables

Store the client ID and secret in your CI platform's secret manager — Azure DevOps variable groups, GitHub Actions repository secrets, or your platform's equivalent. Never commit them to source control.

# Azure DevOps pipeline YAML variables: - group: ipm-secrets env: IPM_CLIENT_SECRETS: $(IPM_CLIENT_SECRETS)

03 — Run

IPM CLI authenticates automatically — no prompts

The IPM CLI detects `IPM_CLIENT_ID` and `IPM_CLIENT_SECRET` in the environment and authenticates silently. No login flow, no interactive step, no pipeline hang.

➜ export IPM_CLIENT_SECRETS="$IPM_SECRET"➜ ipm add --package platform/stack --non-interactivePackage 🛡 platform/stack version 2.0.0 was added to the workspace and is synchronized.

What you get

Authentication that belongs in a pipeline.

Non-interactive authentication

Zero prompts in CI/CD. The IPM CLI detects IPM_CLIENT_ID and IPM_CLIENT_SECRET env vars automatically — no flags, no special commands required.

Role-based access

Viewer: download packages only. Contributor: download and publish. Right permissions, right team — no overprivileged tokens floating around your org.

Organization-scoped tokens

Create secrets scoped to a single organization — no cross-org access by default. Each pipeline gets exactly the scope it needs, nothing more.

Centrally managed

Create, rotate, and revoke secrets from the portal. No need to touch every pipeline when you rotate — update one place, done.

Works everywhere

Azure DevOps, GitHub Actions, Jenkins, GitLab CI, CircleCI — any platform that supports environment variables works out of the box. One pattern, every platform.

No expiry surprises

Client secrets don't expire on a timer. You control the lifecycle — rotate when you choose, not when a token dies at 2am on a Saturday.

In production

One auth pattern.
Every pipeline, every platform.

DevOps team · 12 Azure DevOps pipelines

Zero auth incidents since switching to client secrets

The team was managing PAT tokens per-developer, per-pipeline. Every quarter brought another incident when someone's token expired mid-release. Client secrets replaced all of it — one secret per pipeline scope, managed centrally, no expiry surprises.

Pipeline failures from auth

Pipelines migrated in 1 hour

"We don't think about expiring PATs anymore. Set the secret once in the variable group, done. Every pipeline just works." — Senior DevOps Engineer

MSP · 40+ client CI/CD pipelines

One secret pattern works across all client environments

Managing auth across 40+ client pipelines spanning Azure DevOps, GitHub Actions, and Jenkins was unsustainable. IPMHub client secrets gave a single, consistent pattern — same env vars, same CLI behaviour, every platform.

5 platforms

Covered by one pattern

Bespoke auth implementations

"We standardised the auth pattern across all clients in a week. New client onboarding is two env vars and they're done." — Platform Lead, MSP

Common questions

Client secrets — operational answers.

Authentication failed — what do I check?

Verify IPM_CLIENT_ID and IPM_CLIENT_SECRET are set in the pipeline environment. Check the secret hasn't been revoked in the IPMHub portal. Confirm the org name in your command matches the org the secret was created for.

How do I rotate a client secret?

Revoke the old secret in the portal, create a new one, then update the pipeline variable. No downtime if you add the new secret before revoking the old one — the overlap window lets you rotate safely.

Can one secret access multiple organizations?

No. Secrets are scoped to a single organization by design. Create separate secrets for separate orgs and configure each pipeline independently. This limits blast radius if a secret is ever compromised.

What's the difference between Viewer and Contributor roles?

Viewer can download and install packages. Contributor can also publish new package versions. Use Viewer for deployment-only pipelines to minimise blast radius — only give Contributor to pipelines that actually need to publish.

Bulletproof your
infrastructure automation.

Zero-prompt authentication for every pipeline, every platform. Set two environment variables and your pipelines will never break on auth again.

Create a Client Secret Read the Docs

Business & Enterprise plans Role-based permissions No expiry surprises

➜ export IPM_CLIENT_SECRETS="$IPM_SECRET"➜ ipm add --package platform/secure-stack --non-interactivePackage 🛡 platform/secure-stack version 2.0.0 was added to the workspace and is synchronized.