How to get secret environment variable in AEM Cloud | Community
Skip to main content
M
MengshaJiang
Level 2
August 11, 2025
Solved

How to get secret environment variable in AEM Cloud

  • August 11, 2025
  • 3 replies
  • 680 views

Hi all,

 

We added some secret environment variables in AEM Cloud. And we configured them in our OSGI configurations like below.

{ "api-key":"$[secret:SECRET_VAR_NAME]" }

My question is how can we get this secret value in a service? Do we need to treat this value "$[secret:SERVER_API_KEY]" as a placeholder and resolve it by ourselves? 

 

Thanks,

Mengsha

Best answer by Hemant_arora

Here is sample code

package com.example.core.config;

import org.osgi.service.metatype.annotations.ObjectClassDefinition;
import org.osgi.service.metatype.annotations.AttributeDefinition;

@ObjectClassDefinition(name = "Secret Config", description = "Configuration for accessing a secret")
public @interface SecretConfig {

@AttributeDefinition(name = "API Secret Key", description = "Secret Key for external API")
String api_secret();
}

Reference it in your service implementation
package com.example.core.services.impl;

import com.example.core.config.SecretConfig;
import com.example.core.services.SecretService;

import org.osgi.service.component.annotations.Component;
import org.osgi.service.component.annotations.Activate;
import org.osgi.service.component.annotations.Modified;
import org.osgi.service.component.annotations.Reference;
import org.osgi.service.component.annotations.ConfigurationPolicy;
import org.osgi.service.metatype.annotations.Designate;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@8220494(
service = SecretService.class,
configurationPolicy = ConfigurationPolicy.REQUIRE
)
@Designate(ocd = SecretConfig.class)
public class SecretServiceImpl implements SecretService {

private static final Logger log = LoggerFactory.getLogger(SecretServiceImpl.class);

private String apiSecret;

@580286
@9182423
protected void activate(SecretConfig config) {
this.apiSecret = config.api_secret();
log.info("Secret configuration loaded.");
}

@9944223
public String getSecret() {
return apiSecret;
}
}

3 replies

Kamal_Kishor
Community Advisor
Kamal_KishorCommunity Advisor
Community Advisor
August 11, 2025

@mengshajiang : Secret and environment variables are automatically resolved to your osgi configuration. No customization is required for this once you have created them in cloud manager and created osgi config for it.
Your osgi service or component will resolve it for you.

https://experienceleague.adobe.com/en/docs/experience-manager-learn/cloud-service/developing/advanced/secrets#setting-secrets-in-cloud-manager

 

thanks.

 

 

    Tanneru
    Tanneru
    Level 2
    August 11, 2025

    In AEM Cloud, you configure secrets via the Cloud Manager These secrets become available to your application at runtime, usually as environment variables.

     

    String secretValue = System.getenv("SECRET_ENV_VAR_NAME");

    Hemant_arora
    Hemant_aroraAccepted solution
    Level 8
    August 14, 2025

    Here is sample code

    package com.example.core.config;

    import org.osgi.service.metatype.annotations.ObjectClassDefinition;
    import org.osgi.service.metatype.annotations.AttributeDefinition;

    @ObjectClassDefinition(name = "Secret Config", description = "Configuration for accessing a secret")
    public @interface SecretConfig {

    @AttributeDefinition(name = "API Secret Key", description = "Secret Key for external API")
    String api_secret();
    }

    Reference it in your service implementation
    package com.example.core.services.impl;

    import com.example.core.config.SecretConfig;
    import com.example.core.services.SecretService;

    import org.osgi.service.component.annotations.Component;
    import org.osgi.service.component.annotations.Activate;
    import org.osgi.service.component.annotations.Modified;
    import org.osgi.service.component.annotations.Reference;
    import org.osgi.service.component.annotations.ConfigurationPolicy;
    import org.osgi.service.metatype.annotations.Designate;

    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;

    @8220494(
    service = SecretService.class,
    configurationPolicy = ConfigurationPolicy.REQUIRE
    )
    @Designate(ocd = SecretConfig.class)
    public class SecretServiceImpl implements SecretService {

    private static final Logger log = LoggerFactory.getLogger(SecretServiceImpl.class);

    private String apiSecret;

    @580286
    @9182423
    protected void activate(SecretConfig config) {
    this.apiSecret = config.api_secret();
    log.info("Secret configuration loaded.");
    }

    @9944223
    public String getSecret() {
    return apiSecret;
    }
    }

    M
    MengshaJiangAuthor
    Level 2
    August 15, 2025

    Hi  Hemant_arora,

     

    It worked! Thank you for your reply!

     

    Regards,

    Mengsha

    Terms & ConditionsAccessibility statement

    Loading footer...