> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useparagon.com/llms.txt
> Use this file to discover all available pages before exploring further.

# A Paragraph push or Release cleared client IDs and secrets

> Client IDs, secrets, and environment secrets are dashboard-only. They go missing when a Release treats an integration as an Add.

Breadcrumb

If OAuth client IDs, client secrets, or environment secrets are empty after `para push` or a Release, Paragraph did not copy those values out of git. They are dashboard-only. A normal pull and push of the same project leaves them in place. They disappear when the platform treats the integration as **new** (a delete plus create), which the Release preview labels **Add**, not **Update**.

Check the Release Change Summary before you deploy. If integrations you thought were existing show as Adds, stop and restore identity; do not deploy.

## Symptoms

* After `para push` and a Release (Development → Staging → Production), some integrations have a blank client ID / client secret. Others in the same Release are unchanged.
* You restored integrations from git history after they were deleted from the Paragraph project.
* The Release preview listed those integrations as **Adds**, not **Updates**. You may also have seen [New Integration Requires Additional App Configuration](https://docs.useparagon.com/deploying-integrations/release-environments.md#new-integration-requires-additional-app-configuration).
* Integration and workflow IDs changed, or connected users for that integration were wiped. [Integration Removed](https://docs.useparagon.com/deploying-integrations/release-environments.md#integration-removed) deletes connected accounts and workflows for a removed integration.

You will not see Paragraph files that contain the missing secrets. [Getting Started](https://docs.useparagon.com/paragraph/getting-started.md#what-isnt-defined-in-a-paragraph-project) lists client ID and secret, environment secrets, signing keys, and (for catalog integrations) OAuth scopes as dashboard-only.

## Cause

Paragraph stores workflow and integration *logic*. It does not store OAuth app credentials or environment secrets. `para pull` / `para push` and Git Sync therefore have nothing to write into those dashboard fields on a stable integration.

[Build and Push](https://docs.useparagon.com/paragraph/build-and-push.md) does say that integrations or workflows **absent from the source are removed from the destination**. If someone deletes an integration folder in git, a push removes it from the project. Restoring the files from an old commit can bring back *code* whose IDs no longer match the live project. The next Release then compares by identity and sees **Adds** (create) instead of **Updates** (same integration, new logic).

| Release change type | What happens to credentials |
| - | - |
| **Update** / Modify | Client ID, secret, scopes, and environment secrets on that integration stay. Paragraph never overwrote them. |
| **Add** | This is a new integration in the target environment. OAuth app config is empty until you paste it. The Release warning for additional app configuration is the prompt to do that. |
| **Remove** | The integration is deleted. Connected accounts and its workflows go with it. |

That is why the wipe looks intermittent: integrations that stayed **Updates** keep their secrets; integrations that were **Adds** do not.

## Fix

### 1. Read Add vs Update before you deploy

In the undeployed [Release Preview](https://docs.useparagon.com/deploying-integrations/release-environments.md#creating-a-release), every integration row is Add, Modify, or Remove. Adds that you did not intend mean identity was lost. Cancel the Release, fix Development, and preview again.

### 2. Do not restore a deleted integration from git history and Release it as-is

If the folder was deleted and you need the integration back, recreate it so the project keeps a current identity, or pull from the live dashboard (`para pull`) and re-apply logic on top of those IDs. Pushing an old tree so the platform "adds" seven integrations will mint seven empty credential slots.

### 3. If you already deployed Adds, paste credentials in the dashboard

Open each new integration's Settings and set client ID, secret, and scopes. Re-enter environment secrets if the Release warned they were missing. Connected users for a removed-then-added integration must reconnect.

Optional check to validate Add vs Update: call [Get integration metadata](https://docs.useparagon.com/apis/api-reference.md#getintegrationmetadata-integrationtype-string) before and after a pull/push. If IDs changed, you recreated the integration.

## Prevention

* Treat "absent from git" as a delete of the live integration, per [Build and Push](https://docs.useparagon.com/paragraph/build-and-push.md).
* On every Release, scan the Change Summary for unexpected **Adds** and **Removes** before Deploy.
* Keep client ID, secret, and environment secrets only in the dashboard (and your own secret store). Do not expect git to round-trip them.

## Still having issues?

Send the Release Change Summary (Add/Modify/Remove per integration), whether you restored files from git history, and whether integration IDs changed around the deploy.

## Related articles

* [What isn't defined in a Paragraph project](https://docs.useparagon.com/paragraph/getting-started.md#what-isnt-defined-in-a-paragraph-project)
* [Build and Push](https://docs.useparagon.com/paragraph/build-and-push.md)
* [Release Environments](https://docs.useparagon.com/deploying-integrations/release-environments.md)
* [Setting up Git Sync](https://docs.useparagon.com/paragraph/setting-up-git-sync.md)