Connections
The approval model, and why nothing is open by default.
Deny first
An app reaches nothing until a connection is approved. There is no allowlist to relax, no "development mode" that opens egress, and no way for the app's own code to grant itself access.
supersecret_app_request applies for exactly one destination — one host:port
per request. An administrator sees it in the Apps inbox and approves or refuses
it there. Approval is per connection, never per app.
Kinds of connection
| Kind | What it means |
|---|---|
egress.external | The app calls out to a third party. |
egress.internal | The app calls something on your own network. |
egress.supersecret | The app calls this SuperSecret instance's API. |
ingress.webhook | A third party posts in to the app, through a relay. |
ingress.published | The app is reachable at its published link. |
Credentials
Approving a connection does not hand over a credential. The app's token, key or
connection string is set separately with supersecret_app_set_secret, which
puts it in the app's environment at runtime.
Keeping the two apart means the source an agent wrote never contains the secret, and rotating a credential does not require a redeploy.
When something is refused
The egress proxy records it and it appears in supersecret_app_logs. A refused
call names the destination, so the fix is either to apply for that connection or
to correct the app — not to guess.
Administrators can also bar ranges outright with APPD_DENY_CIDRS, which no
approval can override. Use it for your host's own LAN address and any management
network.