# Populating Integration Test Secrets in AWS Secrets Manager

> **Important**: Do not ask the agent to perform this step. Secret values must never pass through the agent to avoid leaking credentials. Do this manually in the AWS console or via the AWS CLI.

After the terraform PR is merged and applied, the secrets exist in Secrets Manager but are empty. You must populate them before the tests can authenticate.

There are two secret types. The libraries (`jwtauth[testing]` and `@theorchard/backend-jwtauth-testing`) expect a specific JSON shape for each.

## `*_AUTH0_CREDENTIALS` — Auth0 application credentials

Find an existing Auth0 application in the QA tenant (e.g. `settings-login`) or create one dedicated to testing. You need its Client ID and Client Secret.

```json
{
    "auth0_client_id": "<client-id>",
    "auth0_client_secret": "<client-secret>"
}
```

Note: make sure `http://auth0.com/oauth/grant-type/mfa-otp` is in the Auth0 client's grant types if your user has MFA enabled.

## `*_USER_CREDENTIALS` — integration test user credentials

This is the email/password of the Auth0 user you created. If the user has OTP MFA enabled, include the `otp_secret_key` (the secret you copied when setting up MFA via Google Authenticator). If MFA is disabled (`bypass_mfa: true` in user metadata), set `otp_secret_key` to `null`.

```json
{
    "email": "my-service-integration-test+role-name@sonymusic-pde.com",
    "password": "<password>",
    "otp_secret_key": "<otp-secret-or-null>"
}
```

Once you've populated both secrets, confirm the tests can authenticate before proceeding. Full setup reference: [How to integration test authenticated endpoints using real JWTs](https://www.notion.so/How-to-integration-test-authenticated-endpoints-using-real-JWTs-699b4ea8b0f242c1b53bc124ae76ea2b).