The recommended way to make the secret key available in the AEM application is to use an environment variable which is then consumed by an OSGi configuration. This way, the secret key is not stored in the code base or in the repository, but rather in a secure and encrypted way in the Cloud Manager environment variables. The OSGi configuration can use a placeholder to reference the environment variable and inject its value at runtime. References: https://experienceleague.adobe.com/docs/experience-manager-cloud-service/implementing/deploying/configuring-osgi.html?lang=en#environment-variables https://experienceleague.adobe.com/docs/experience-manager-cloud-service/implementing/deploying/environment-variables.html?lang=en