---
title: FileSystemSecretStore
description: Manage a store of secrets held in files, specified as follows:
component: pinggateway
version: 7.2
page_id: pinggateway:reference:FileSystemSecretStore
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/FileSystemSecretStore.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-06-02T16:30:54Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/FileSystemSecretStore.html
section_ids:
  FileSystemSecretStore-usage: Usage
  FileSystemSecretStore-properties: Properties
  FileSystemSecretStore-log: Log level
  FileSystemSecretStore-example: Example
  FileSystemSecretStore-moreinfo: More information
---

# FileSystemSecretStore

Manage a store of secrets held in files, specified as follows:

* Each file must contain only one secret.

* The file must be in the directory specified by the property `directory`.

* The filename must match the `mappings` property `secretId`.

* The file content must match the `mappings` property `format`. For example, if the mapping specifies `BASE64`, the file content must be base64-encoded.

Secrets are read lazily from the filesystem.

The secrets provider queries the FileSystemSecretStore for a named secret, identified by the name of a file in the specified directory, without the prefix/suffix defined in the store configuration. The FileSystemSecretStore returns the secret that exactly matches the name.

The secrets provider builds the secret, checking that the secret's constraints are met, and returns a unique secret. If the secret's constraints are not met, the secrets provider cannot build the secret and the secret query fails.

For a description of how secrets are managed, see [Secrets](../gateway-guide/about.html#about-secrets).

## Usage

```json
{
  "name": string,
  "type": "FileSystemSecretStore",
  "config": {
    "directory": configuration expression<string>,
    "format": SecretPropertyFormat reference,
    "suffix": configuration expression<string>,
    "mappings": [ object, ... ],
    "leaseExpiry": configuration expression<duration>
  }
}
```

## Properties

* `"directory"`: *configuration expression<[string](preface.html#definition-string)>, required*

  File path to a directory containing secret files. This object checks the specified directory, but not its subdirectories.

- `format`: *SecretPropertyFormat [reference](preface.html#definition-reference), optional*

  Format in which the secret is stored. Use one of the following values, or define a format:

  * `BASE64`: Base64-encoded

  * `PLAIN`: Plain text

  Default: `BASE64`

- `"suffix"`: *configuration expression<[string](preface.html#definition-string)>, optional*

  File suffix.

  When set, the FileSystemSecretStore will append that suffix to the secret ID and try to find a file with the mapped name.

  Default: None

* `"mappings"`: *array of [objects](preface.html#definition-object), optional*

  One or more mappings to define a secret:

  * `secretId`: *configuration expression<[secret-id](preface.html#definition-secretid)>, required*

    The ID of the secret used in your configuration.

  * `format`: *SecretPropertyFormat [reference](preface.html#definition-reference), required*

    The format and algorithm of the secret. Use [SecretKeyPropertyFormat](SecretKeyPropertyFormat.html) or [PemPropertyFormat](PemPropertyFormat.html).

- `"leaseExpiry"`: *configuration expression<[duration](preface.html#definition-duration)>, optional*

  The amount of time that secrets produced by this store can be cached before they must be refreshed.

  If the duration is `zero` or `unlimited`, IG issues a warning, and uses the default value.

  Default: 5 minutes

## Log level

To facilitate debugging secrets for the FileSystemSecretStore, in `logback.xml` add a logger defined by the fully qualified package name of the property resolver. The following line in `logback.xml` sets the log level to `ALL`:

```xml
<logger name="org.forgerock.secrets.propertyresolver" level="ALL">
```

## Example

For an example that uses FileSystemSecretStore, see [Pass Runtime Data in a JWT Signed With a PEM](../gateway-guide/runtime.html#runtime-signed-pem-example).

## More information

[Secrets](secrets.html)

[org.forgerock.openig.secrets.FileSystemSecretStoreHeaplet](../_attachments/apidocs/org/forgerock/openig/secrets/FileSystemSecretStoreHeaplet.html)