Allow configuring secret masking functionality

[EnturWilhelm]

Checklist

• I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

After #1103 was merged into main, Auth0 Deploy CLI can no longer be used as a full backup solution of our Auth0 tenants. I.e. the recommendations in https://support.auth0.com/center/s/article/Backup-Auth0-Data no longer hold true.

This is especially concerning for us with regards to backing up our enterprise connections, where we rely on an externally provided secret for the the connection to work properly. If we are unable to create a backup of these secrets, we'll have to manually retrieve them from our partners in the case of a configuration loss.

Describe the ideal solution

We would highly appreciate if a new setting could be added to the configuration to toggle whether secrets are redacted or not when performing tenant exports. Else we have to add new delta patches to patch out the overrides in https://github.com/auth0/auth0-deploy-cli/blob/master/src/context/defaults.ts.

Alternatives and current workarounds

Delta patching the Auth0 Deploy CLI release.

Additional context

No response

[kushalshit27]

Hi, @EnturWilhelm ,
Thank you for this suggestion.

Regarding the export of credentials or secrets, we generally advise against it to maintain stronger security standards, which is why we set this as the default behaviour. Additionally, many newer Auth0 management endpoints no longer expose secrets/credentials in their responses by design.

However, to support specific use cases, we will look into adding an optional flag that allows users to retrieve credentials or secrets specifically in cases where they are still exposed by the Auth0 management API. 🤝

We will keep you updated as we discuss the best path forward. Thank you for helping us navigate these features!

[EnturWilhelm]

Hi,
Thanks for the reply, and I see definitely see your point. However, this presents a problem with regards to the self-service nature of enterprise connections. The API is literally the only place where we can retrieve those secrets and ensure swift disaster recovery. I.e. it is necessary for us to be able to take backups of them.