Hello, question about webhooks in the broker, specifically about the authorization part to one of the repository cloud systems (e.g. bitbucket). In the documentation , the authorization part (with the token) is created (and stored in the broker) when you create a webhook. I am going to assume the pact broker, everytime when the webhook triggers it retrieves this token and then executes the pipeline. However we do not want the authorization token to be stored and retrieved in the broker. Instead, we want to to grab this token dynamically form a secure location in the repository cloud system. Is there someway we can set this up in the broker?

the open source broker doesn’t offer that functionality (retrieval of secrets from external sources) if you were able to do that, how would you ensure that your broker can access the secure location? surely they would need a token for that, and you are back at storing a token in the broker? you could have your broker call a proxy configured in your network, that acts as a gateway to your internal system, implementation may vary dependant on setup.

Thanks @Yousaf Nabi (pactflow.io). Not sure if the proxy 'route' you mentioned will solve our issue. And you make a great point about retrieval from the secure location (via token again 😛 ). I will try going the NPA route then. Security team might ask questions then though. Is there any way to retrieve the value as plain text of the token in the broker ui, via hal browser api/cli broker tools command? How is the password stored encryped (algorith used) in the postgres database? Thanks again 🙂