Skip to main content
If OAuth client IDs, client secrets, or environment secrets are empty after para push or a Release, Paragraph did not copy those values out of git. They are dashboard-only. A normal pull and push of the same project leaves them in place. They disappear when the platform treats the integration as new (a delete plus create), which the Release preview labels Add, not Update. Check the Release Change Summary before you deploy. If integrations you thought were existing show as Adds, stop and restore identity; do not deploy.

​
Symptoms

  • After para push and a Release (Development → Staging → Production), some integrations have a blank client ID / client secret. Others in the same Release are unchanged.
  • You restored integrations from git history after they were deleted from the Paragraph project.
  • The Release preview listed those integrations as Adds, not Updates. You may also have seen New Integration Requires Additional App Configuration.
  • Integration and workflow IDs changed, or connected users for that integration were wiped. Integration Removed deletes connected accounts and workflows for a removed integration.
You will not see Paragraph files that contain the missing secrets. Getting Started lists client ID and secret, environment secrets, signing keys, and (for catalog integrations) OAuth scopes as dashboard-only.

​
Cause

Paragraph stores workflow and integration logic. It does not store OAuth app credentials or environment secrets. para pull / para push and Git Sync therefore have nothing to write into those dashboard fields on a stable integration. Build and Push does say that integrations or workflows absent from the source are removed from the destination. If someone deletes an integration folder in git, a push removes it from the project. Restoring the files from an old commit can bring back code whose IDs no longer match the live project. The next Release then compares by identity and sees Adds (create) instead of Updates (same integration, new logic). That is why the wipe looks intermittent: integrations that stayed Updates keep their secrets; integrations that were Adds do not.

​
Fix

​
1. Read Add vs Update before you deploy

In the undeployed Release Preview, every integration row is Add, Modify, or Remove. Adds that you did not intend mean identity was lost. Cancel the Release, fix Development, and preview again.

​
2. Do not restore a deleted integration from git history and Release it as-is

If the folder was deleted and you need the integration back, recreate it so the project keeps a current identity, or pull from the live dashboard (para pull) and re-apply logic on top of those IDs. Pushing an old tree so the platform “adds” seven integrations will mint seven empty credential slots.

​
3. If you already deployed Adds, paste credentials in the dashboard

Open each new integration’s Settings and set client ID, secret, and scopes. Re-enter environment secrets if the Release warned they were missing. Connected users for a removed-then-added integration must reconnect. Optional check to validate Add vs Update: call Get integration metadata before and after a pull/push. If IDs changed, you recreated the integration.

​
Prevention

  • Treat “absent from git” as a delete of the live integration, per Build and Push.
  • On every Release, scan the Change Summary for unexpected Adds and Removes before Deploy.
  • Keep client ID, secret, and environment secrets only in the dashboard (and your own secret store). Do not expect git to round-trip them.

​
Still having issues?

Send the Release Change Summary (Add/Modify/Remove per integration), whether you restored files from git history, and whether integration IDs changed around the deploy.