# Documentation for all secrets

**URL:** <https://forum.gitea.com/t/documentation-for-all-secrets/7439>\
**Category:** Install/Maintain/Configure\
**Created:** [June 17, 2023, 1:09am UTC](https://forum.gitea.com/t/documentation-for-all-secrets/7439 "2023-06-17T01:09:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![lonix1](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/lonix1/32/3790_2.png) [@lonix1](https://forum.gitea.com/u/lonix1)\
**Post date:** [June 17, 2023, 1:09am UTC](https://forum.gitea.com/t/documentation-for-all-secrets/7439/1 "2023-06-17T01:09:01Z")

</div>

There are four configurable secrets, and they are listed in the [cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet).

But they are not properly documented - I am unsure what each is used for.

- **`INTERNAL_TOKEN`** : _“Secret used to validate communication within Gitea binary.”_  
I’m not a go dev, so it’s not obvious to me what that means. Should I set this to a custom value in my `app.ini`?

- **`JWT_SECRET`** : _“OAuth2 authentication secret for access and refresh tokens…”_  
I’m using username/password auth, so I assume I can ignore this?

- **`LFS_JWT_SECRET`** : _“LFS authentication secret, change this a unique string”_  
I’m using git lfs, but not oauth. Should I still set this?

- **`SECRET_KEY`** : _“Global secret key. This key is VERY IMPORTANT, if you lost it, the data encrypted by it (like 2FA secret) can’t be decrypted anymore”_  
I don’t use oauth or 2fa. Should I still set this? (What other data does it encrypt?)

Thanks for your help!