An app declares what it needs and the dashboard renders a form from it. That is why setup is a few fields rather than a configuration file.
The kinds of field
| Type | What it is |
|---|---|
| Text | A single line |
| Text area | Several lines |
| Number | A numeric value |
| URL | A link, validated as one |
| Yes or no | A toggle |
| Select | A list of choices |
| Date and time | A picker |
| Image | An upload, for a logo or a background |
| Secret | A sensitive value, write-only once saved |
The image field matters more than it sounds. An app that needs a logo used to require hosting the file somewhere and pasting a URL; now it takes an upload.
Some apps also expose fields backed by a connected service, which become dropdowns of your own dashboards or calendars rather than fields you fill in by hand. See Connected services.
Secrets
A secret is for anything that should not be readable afterwards: an API token, a password, a private URL.
Store credentials as secrets, not as settings. An ordinary setting is visible to anyone with access to the workspace. A secret is not, including to administrators.
How a secret is protected
It is encrypted as soon as you save it, and never stored in plain text.
It reaches the device still encrypted, and only the device that owns that app instance can decrypt it. The decryption key never leaves the device.
On a Player Max, decryption uses the device’s Trusted Platform Module: a dedicated chip holding the key in hardware, bound to that physical device and not extractable even with direct access to its storage. On other hardware, it uses a device-specific certificate on disk, so a secret encrypted for one device cannot be decrypted on another.
Write-only
Once saved, a secret cannot be read back, through the dashboard or the API. You can overwrite it; you cannot retrieve it. If you lose the value, regenerate the credential in the service it belongs to and save the new one.
Apps are isolated from each other
Each app runs in a sandbox and cannot read the files, settings, or secrets of another app on the same device. One compromised app has no path to another’s data.
Where an app is rendered on our infrastructure rather than on the device, isolation is stricter still: it has no access to the device’s local network or filesystem at all. See Where an app runs.