Tracecat requires four secrets. Generate them with `openssl`:

```bash
# Service key (hex, 32 bytes) — used for internal service-to-service JWT signing
openssl rand -hex 32

# Signing secret (hex, 32 bytes) — used for webhook URL signing and HMAC operations
openssl rand -hex 32

# User auth secret (hex, 32 bytes) — used for OAuth state and password reset tokens (API only)
openssl rand -hex 32

# DB encryption key (Fernet-compatible base64, 32 bytes) — used for encrypting secrets at rest
openssl rand 32 | base64 | tr -d '\n' | tr '+/' '-_'
```

<Warning>
  Store these securely. Losing `TRACECAT__DB_ENCRYPTION_KEY` makes encrypted credentials unrecoverable.
  Losing `TRACECAT__SIGNING_SECRET` invalidates existing webhook URLs.
</Warning>
