Secrets and key vaults

Recommended storage

Use your organization's approved key vault or secrets manager for Printix client secrets. Keep secrets out of source code, checked-in configuration, PowerShell profiles, shell history, tickets and logs. Do not store a plaintext secret in a script and convert it to SecureString: conversion does not protect the original literal.

Client IDs, tenant IDs and partner IDs identify the connection but are not substitutes for the client secret. Treat them according to your organization's configuration policy; the examples use placeholders, not real credentials.

Choose a maintained vault provider with access control, audit logging and a rotation process. Prefer a workload identity or other passwordless authentication to the vault where supported, rather than storing another long-lived vault password beside the script. Vault authentication does not replace Printix's OAuth client-secret requirement.

Prepare a vault for the examples

The Cloud Print overview and Partner guide use Microsoft.PowerShell.SecretManagement as an optional provider-neutral adapter:

1. Install it if you choose to use these examples:

   Install-Module -Name Microsoft.PowerShell.SecretManagement -Repository PSGallery -Scope CurrentUser

2. Select and install your organization's approved vault extension. Follow that provider's instructions to authenticate and register it with Register-SecretVault under the local name OrganizationVault, or substitute your existing registration name in the examples. Registration and authentication are provider-specific; installing SecretManagement alone does not create a vault.

3. Provision the secrets through your approved administrative process. Use separate string secrets such as Printix-CloudPrint-ClientSecret, Printix-WorkstationMonitoring-ClientSecret and Printix-Partner-ClientSecret. These names are examples, not automatically created resources.

4. Grant the runtime identity read access only to the secrets it needs. Restrict write/rotation privileges separately. Register and test the vault under the identity and on the machine that will actually run the script.

5. Confirm registration and connectivity without displaying secret values:

   Import-Module Microsoft.PowerShell.SecretManagement -ErrorAction Stop
   Get-SecretVault -Name 'OrganizationVault' -ErrorAction Stop
   if (-not (Test-SecretVault -Name 'OrganizationVault' -ErrorAction Stop)) {
       throw 'Vault connectivity test failed.'
   }

Specify -Vault on every Get-Secret call so the lookup cannot silently select an identically named secret in another registered vault. Use -ErrorAction Stop; do not fall back to hard-coded credentials when retrieval fails.

SecretManagement returns string secrets as SecureString by default. Store the client secret as a string secret, not a credential object or hashtable, and pass it directly to ClientSecret. Do not use -AsPlainText or print the retrieved value. See the official Get-Secret reference and SecretManagement overview.

SecretManagement is feature-complete and receives security and critical fixes, not active feature development. It is one integration option, not a required Printix dependency. An approved provider's own supported SDK or PowerShell module can also retrieve secrets; ensure the resulting ClientSecret is a SecureString and avoid unnecessary plaintext copies.

Interactive alternative

For a one-off session where vault integration is not available, prompt without putting a secret literal into history:

$ConnectPrintixParams = @{
    ClientId = 'your-cloud-print-client-id'
    ClientSecret = Read-Host 'Cloud Print API client secret' -AsSecureString
    TenantId = 'your-tenant-id'
    ErrorAction = 'Stop'
}
Connect-Printix @ConnectPrintixParams
Remove-Variable ConnectPrintixParams

A secure prompt is not persistent secret storage and is unsuitable for unattended jobs. Do not substitute a plaintext literal or an environment variable and assume SecureString makes the original source safe.

Unattended operation

Configure vault access for the actual scheduled-task, service or automation identity. An interactive user's vault registration or cached sign-in might not exist in that context. Confirm the job can retrieve only its required secret without an interactive unlock prompt.

Use separate secrets for mutually exclusive Printix application types and for Partner API credentials. Separate vault authorization where possible, especially for partner-wide operations. Never use production credentials in mocked tests; the module's build and test pipelines do not need live Printix access.

Rotation and connection lifetime

1. Rotate or replace the secret using Printix's supported application management process and update the corresponding vault entry.
2. Coordinate affected jobs; do not assume overlapping credentials are supported.
3. Disconnect the old connection and retrieve the updated vault secret before reconnecting. Existing connections do not reread the vault during token renewal.
4. Verify the required operation and remove superseded credentials according to your organization's policy.

The module retains credentials and tokens in memory for renewal. Removing the caller hashtable only removes that reference; it does not erase the module's connection. Clear the appropriate connection when work finishes:

Disconnect-Printix
Disconnect-PrintixPartner

These clear independent connection states. They do not revoke credentials or tokens at Printix, delete vault entries, or guarantee immediate memory erasure. SecureString is not protection against a compromised process or host and does not offer the same memory protection on every operating system.

Avoid logging connection parameter objects, authorization headers, access/refresh tokens, signed upload URLs or sensitive API user responses. When reporting an error, share only redacted diagnostics and the relevant Printix error ID/timestamp.