# GATEWAY\_ENCODING\_KEY documentation **URL:** \ **Category:** Ignition\ **Tags:** database, ignition81, scripting\ **Created:** [March 19, 2024, 6:13pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579 "2024-03-19T18:13:48Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Matthew\_Boyers](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matthew_boyers/32/59236_2.png) [@Matthew\_Boyers](https://forum.inductiveautomation.com/u/Matthew_Boyers)\ **Post date:** [March 19, 2024, 6:13pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/1 "2024-03-19T18:13:48Z")
Is there any documentation or examples on how to use the environment variables GATEWAY\_ENCODING\_KEY and GATEWAY\_ENCODING\_KEY\_FILE? We are using Ignition 8.1.38 and are hoping to be able to use these environmental variables to pass database credentials in a JDBC connection. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 19, 2024, 6:35pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/2 "2024-03-19T18:35:16Z")
The "encoding key" is a by default hardcoded key in the software that is used to _obfuscate_ credentials stored inside the internal database, a SQLite file. Since approximately forever, you've been able to specific a different encoding key via a JVM arg, i.e. in your ignition.conf file. But that's not very friendly for containerized applications, which is why new support for environment variables was added in 8.1.38. This is all a bit moot, though; proper credential management using external secret stores is planned for Ignition 8.3. Also, if it's not clear, this encryption key doesn't _directly_ relate to any particular use such as a DB connection in Ignition - it's a single secret that is used to hash **every** credential stored in the internal DB. ---
**Author:** ![Adriano\_Generoso\_da](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adriano_generoso_da/32/43895_2.png) [@Adriano\_Generoso\_da](https://forum.inductiveautomation.com/u/Adriano_Generoso_da)\ **Post date:** [June 20, 2024, 12:48pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/3 "2024-06-20T12:48:54Z")
Regarding this change. If we replace the encoding key, with an existing gateway, the system hashes the code with the new key, or will required to reenter the passwords? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2024, 1:16pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/4 "2024-06-20T13:16:50Z")
I don't think modifying this key for an existing Ignition Gateway is supported - it must be set before any development begins. ---
**Author:** ![Adriano\_Generoso\_da](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adriano_generoso_da/32/43895_2.png) [@Adriano\_Generoso\_da](https://forum.inductiveautomation.com/u/Adriano_Generoso_da)\ **Post date:** [June 21, 2024, 10:34am UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/5 "2024-06-21T10:34:15Z")
IA have plan to have a migration process? If I need to replace the key, without needing to setup a new gateway? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 21, 2024, 12:06pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/6 "2024-06-21T12:06:46Z")
No, this whole mechanism will be deprecated in 8.3 and a proper secrets management solution will be introduced. ---
**Author:** ![kgamble](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kgamble/32/8019_2.png) [@kgamble](https://forum.inductiveautomation.com/u/kgamble)\ **Post date:** [September 9, 2024, 12:20pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/7 "2024-09-09T12:20:46Z")
> [@paul-griffith](#): > > Since approximately forever, you've been able to specific a different encoding key via a JVM arg, i.e. in your ignition.conf file. Is this JVM arg documented somewhere? (Need it for an older gateway version) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 9, 2024, 12:48pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/8 "2024-09-09T12:48:53Z")
I only see it documented as Docker env variable. What do you need to know? ---
**Author:** ![kgamble](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kgamble/32/8019_2.png) [@kgamble](https://forum.inductiveautomation.com/u/kgamble)\ **Post date:** [September 9, 2024, 12:50pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/9 "2024-09-09T12:50:47Z")
I am injecting some stuff into the IDB of a gateway in a container pre-8.1.38 and need to set a custom encoding key for it I might be misunderstanding this, but I seem to read this as its possible with whatever this JVM arg would be > [@paul-griffith](#): > > Since approximately forever, you've been able to specific a different encoding key via a JVM arg, ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 9, 2024, 12:53pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/10 "2024-09-09T12:53:57Z")
You can set `-DencodingKey=whatever` in the ignition.conf additional args. But that encoding key already would have been set in that container, so I'm not sure what you're really doing here... the encoding key cannot be set retroactively or all existing encoded secrets will stop working. ---
**Author:** ![kgamble](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kgamble/32/8019_2.png) [@kgamble](https://forum.inductiveautomation.com/u/kgamble)\ **Post date:** [September 9, 2024, 12:57pm UTC](https://forum.inductiveautomation.com/t/gateway-encoding-key-documentation/87579/11 "2024-09-09T12:57:04Z")
> [@Kevin.Herron](#): > > But that encoding key already would have been set in that container, so I'm not sure what you're really doing here... the encoding key cannot be set retroactively or all existing encoded secrets will stop working. It's actually for a new container, not an old one, it just happens to be in the older version. So it shouldn't be set yet when my container starts up