# Store secrets

**Portal version:** 0.1.0  
**Updated:** 2026-08-28  
**Source menu item:** Store secrets  
**Availability:** Documented and testable

> The source contract and local workflow exist. Access still depends on the target hospital deployment and its policy gates.

Keep FHIR keys, webhook secrets, signing keys, and partner credentials on the server or in an approved vault.

## What you can use now

- Use environment/vault references and rotate credentials independently from app releases.
- Redact paths and secret bytes from logs and handoff evidence.

## Current limits

- medOS does not expose a public browser Secret Store API.

## Next step

Start with the [medOS Developer overview](/developers/platform/overview) and confirm the target hospital’s enabled contracts before production work.

## Canonical references

- [FHIR R4 integration](/integrations/fhir)
- [Public API](/backend/public-api)
- [Security and compliance](/architecture/security-and-compliance)
- [Developer portal status and coverage](/developers/platform/changelog)