# Remote Secret Provider

**URL:** <https://forum.inductiveautomation.com/t/remote-secret-provider/113818>\
**Category:** Ignition\
**Created:** [February 6, 2026, 3:50pm UTC](https://forum.inductiveautomation.com/t/remote-secret-provider/113818 "2026-02-06T15:50:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![felipemvcab](https://avatars.discourse-cdn.com/v4/letter/f/53a042/32.png) [@felipemvcab](https://forum.inductiveautomation.com/u/felipemvcab)\
**Post date:** [February 6, 2026, 3:50pm UTC](https://forum.inductiveautomation.com/t/remote-secret-provider/113818/1 "2026-02-06T15:50:17Z")

</div>

I am using 8.3.3 and configured 1 gateway to hold a local secret provider and also have 2 other gateways all networked together. The other two gateways have a remote secrets provider that points to the 1 gateway with the local secret provider.

When I run the function system.secrets.readSecretValue at any of the two gateways with a remote secrets provider, I get the following access error.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/3/33b74d4b20e9e82c707cb0ef3a6909c5f7028426.png)

Is there any security configuration at the gateway with the local secret provider that I must configure first?

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [February 6, 2026, 4:38pm UTC](https://forum.inductiveautomation.com/t/remote-secret-provider/113818/2 "2026-02-06T16:38:03Z")

</div>

You must enable remote access in the service security settings, following the same process as remote tags/historians/etc.

> **[Service Security Policies | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.3/platform/security/service-security)**
>
> Policies can be defined for each Security Zone. Security Zones and their policies can be found within the Platform section of the Gateway under Security \> Zones.

---

<div class="post-metadata">

**Author:** ![felipemvcab](https://avatars.discourse-cdn.com/v4/letter/f/53a042/32.png) [@felipemvcab](https://forum.inductiveautomation.com/u/felipemvcab)\
**Post date:** [February 6, 2026, 5:48pm UTC](https://forum.inductiveautomation.com/t/remote-secret-provider/113818/3 "2026-02-06T17:48:44Z")

</div>

Thanks Paul,

1-Added a new security zone

2-Under the Identifiers of the zone, I added the Gatway Names that are pointing to the Gateway with the local secret.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/9/8947a5b86e40597fa67fe26388000cc51a58fc29.png)

3-In the Manage Policy of the Zone, Enabled the service access for Secret Provider, and for my local secret provider I set it to read only.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/7/17512fd3832b6720a5aa71c566f42532d0d867bc.png)

4- Went back to the remote gateways and was able to retrieve the secrets.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/1/018967c65b5e1d71af021921d65fcb33dd6c9fb8.png)

---

<div class="post-metadata">

**Author:** ![Jesse\_Van\_Hill](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jesse_van_hill/32/56876_2.png) [@Jesse\_Van\_Hill](https://forum.inductiveautomation.com/u/Jesse_Van_Hill)\
**Post date:** [February 20, 2026, 5:12pm UTC](https://forum.inductiveautomation.com/t/remote-secret-provider/113818/4 "2026-02-20T17:12:08Z")

</div>

A little late to this post, but be sure in your production code that you clear the Plaintext instance when you are finished.

Either call `clear()` directly, or better yet use a `with/as` syntax to handle the clear for you:

```python
with system.secrets.readSecretValue("RemoteSecretsFromMaster", "Secret1") as plaintext:
  print plaintext.getSecretAsString()

```