Secrets and registry access

The DataMind Installer downloads every DataMind OS image, deployment file and update from a registry, and it signs in with one of two credentials: the DataMind Platform API key, or the Azure client secret that comes with a DataMind-issued client_id and client_secret. Both live in System secrets on the Configuration screen.

This page covers where the credentials come from, how the Installer checks them, and what it downloads with them.

Where images and files come from

What is stored	When it is used	Where the Installer gets its images and files
A DataMind Platform API key	As soon as it is stored; it wins over the secret	The DataMind Platform gateway, `platform.datamind.ai`
An Azure client secret	Only while no key is stored	Azure: its container registry and file storage

With a key, the host itself needs no Azure access. Every stack image and tag, the environment template, the Compose file, the memory slice script and the Installer's own image come from platform.datamind.ai.

The two system secrets

System secrets holds both rows:

Row	What it holds
`PLATFORM_API_KEY`	Your DataMind Platform API key. The same key DataMind OS uses for AI requests
`AZURE_CLIENT_SECRET`	The Azure client secret, used only when no key is stored

Each row reads Configured or Not set. Hover the icon beside a value to see the rule: Secret — value is stored encrypted and never shown. Secrets are stored encrypted in the Installer's database and are never displayed again.

A stored key is shown only as a short hint you can recognise: the start of the key, or the last four characters when the key has another format. The full value never leaves the Installer.

When the DataMind Platform rejects the stored key, the row shows a warning icon with the tooltip The stored DataMind Platform API key was rejected — paste it again. The Azure row shows a warning icon the same way when Azure rejects the secret.

Only admins change these rows; other accounts see them read-only, masked. See Users.

Change or recover the DataMind Platform API key

When no key is stored yet, the Installer looks for one in this order:

PLATFORM_API_KEY in its own .env. It seeds the key on the first start only; changing it later has no effect. See What lives on the host.
The key DataMind OS already holds, under Administration → AI Configuration.
A key you paste, on the setup screen or in System secrets.

After that, DataMind OS owns the key: when it holds a different key that the DataMind Platform accepts, the Installer adopts it at its next check, and the screen warns you when the two copies differ.

To replace or recover it:

Copy the active key from Settings in the DataMind Platform console. An Administrator there can also rotate it.
Set the same key in DataMind OS under Administration → AI Configuration, so both copies match.
Paste it into PLATFORM_API_KEY in System secrets and save. The Installer checks it with platform.datamind.ai before it stores it.

When a check or a save fails:

What you see	What it means	What to do
`The key was not saved because platform.datamind.ai could not validate it: …`	The Installer could not complete the check before saving; the reason follows	Fix the reason, usually outbound access, and save again
`platform.datamind.ai did not accept this API key. Copy it again from the DataMind Platform.`	The gateway answered that the key is not valid	Copy the active key again and paste it
`Stored platform API key could not be decrypted (encryption key changed?). Re-enter it.`	The Installer's encryption key changed or was lost, for example after a restore	Restore it from your backup, or paste the key again. See Backup and restore

The fixes, message by message, are in Troubleshooting.

The Azure client secret

The Azure client secret is the fallback. It is used only while no platform key is stored, and it signs the Installer in to the Azure registry and the file storage behind it. When Azure stops accepting it, the row shows a warning icon; request a new secret from DataMind and paste it in System secrets.

If the Installer can no longer read the stored secret, the message reads Stored Azure client secret could not be decrypted (encryption key changed?). Re-enter it. Paste it again, or restore the Installer's encryption key from your backup, as Backup and restore describes.

The registry area

The registry work runs against whichever source is active:

List the stack's images and tags. Admins can see what the source offers for each image the stack uses.
Download the environment template. A downloaded template seeds the configuration: it fills the rows you edit on Configuration.
Download the Compose file. This is the stack definition the Installer deploys.

These actions are admin-only. The Installer also runs the same downloads by itself during an install and at the downloading phase of every update, so you rarely need to fetch them by hand.

A download that fails names the source it used, so you can fix the right credential:

Failed to download env template from the DataMind Platform: …
Failed to download env template from Azure: …

The Compose file download reads the same way, with docker-compose.yml in place of env template.

Check it worked

Open Configuration → System secrets. The rows you use read Configured and show no warning icon, and the next install or update pulls every image without a registry error.

Questions, answered

Where does the Installer get the API key on the first start?

From PLATFORM_API_KEY in its own .env, else from DataMind OS, else you paste it. See Install on a fresh host and What lives on the host.

The Installer says DataMind OS holds a different key. Which one is used?

DataMind OS's. The Installer adopts its key whenever the DataMind Platform accepts it. Set the same key in DataMind OS under Administration → AI Configuration.

Can I see the stored key or client secret?

No. Each row shows only a short hint: the start of the key, or the last four characters for another format. The full value is never shown or returned.

Do I still need the Azure client secret when a key is stored?

No. With a key, every image, file and update comes from the DataMind Platform, and the host needs no Azure access.

Why was my new key not saved?

The Installer checks every key with platform.datamind.ai before storing it. Fix the reason in the message, usually outbound access, and save again. See Troubleshooting.

Why can the stored key no longer be read?

The Installer's encryption key changed or was lost, for example after a restore, so the stored value can no longer be decrypted. Restore it from your backup, or paste the key again. See Backup and restore.

Does the same key serve AI requests as well?

Yes. It is the same key DataMind OS uses for AI requests, and DataMind OS owns it under Administration → AI Configuration.

What does the `AI_API_KEY` row show while a key is stored?

It becomes read-only, labelled Managed by DataMind Installer, and follows the stored key. See Configuration.

Who can manage the system secrets?

Admins. Other accounts see the screen read-only, with the values masked. See Users.

Which source do updates use?

The same one installs use: the DataMind Platform while a key is stored, else Azure. See Updating.