Configuration
Secrets
#### Types of Secrets {#docs:configuration:secrets_manager::types-of-secrets}  
Secrets are typed, their type identifies which service they are for. Currently, the following cloud services are available:  
* AWS S3 (` S3`), through the [`httpfs` extension](#docs:extensions:httpfs:s3api)
* Azure Blob Storage (` AZURE`), through the [`azure` extension](#docs:extensions:azure)
* Cloudflare R2 (` R2`), through the [`httpfs` extension](#docs:extensions:httpfs:s3api)
* Google Cloud Storage (` GCS`), through the [`httpfs` extension](#docs:extensions:httpfs:s3api)
* Hugging Face (` HUGGINGFACE`), through the [`httpfs` extension](#docs:extensions:httpfs:hugging_face)
* MySQL (` MYSQL`), through the [`mysql` extension](#docs:extensions:mysql)
* PostgreSQL (` POSTGRES`), through the [`postgres` extension](#docs:extensions:postgres)  
For each type, there are one or more “secret providers” that specify how the secret is created. Secrets can also have an optional scope, which is a file path prefix that the secret applies to. When fetching a secret for a path, the secret scopes are compared to the path, returning the matching secret for the path. In the case of multiple matching secrets, the longest prefix is chosen.  
#### Creating a Secret {#docs:configuration:secrets_manager::creating-a-secret}  
Secrets can be created using the [`CREATE SECRET` SQL statement](#docs:sql:statements:create_secret).
Secrets can be **temporary** or **persistent**. Temporary secrets are used by default – and are stored in-memory for the life span of the DuckDB instance similar to how settings worked previously. Persistent secrets are stored in **unencrypted binary format** in the `~/.duckdb/stored_secrets` directory. On startup of DuckDB, persistent secrets are read from this directory and automatically loaded.