---
schema_version: "1"
id: 9dabc8f206d87dd46f68d74e9a3e0ba44fd9aa3046889d6344746fc96be46536
title: Defining and Securing Properties for a Mule Application
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/anypoint-code-builder/int-create-secure-configs.md
canonical_url: https://docs.mulesoft.com/anypoint-code-builder/int-create-secure-configs
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 50087e9f887636ee23650cbfd7a420d80544f5f4bd0b46e07ddf2c04c94b876b
description: MuleSoft Documentation Site
latest: true
---
---
product: Anypoint Code Builder
version: master
---

# Defining and Securing Properties for a Mule Application

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Define configuration properties to secure and customize your Mule application configuration for
different deployment environments.

- Encrypt sensitive values used in your Mule application.

- Define and use variables instead of literal strings when setting values in the configuration XML.

- Configure a variable for selecting different property files for a specific deployment environment,
  such as development, sandbox, or production.

![Diagram showing secure properties flow from runtime argument to global-configs.xml to encrypted properties file to flow references](/mulesoft/current/en-us/anypoint-code-builder/_images/int-secure-properties-overview-diagram.png)

Figure 1. How secure properties work

For a guided, conversational approach to setting up secure properties, use MuleSoft Vibes. For
additional information, see
[Working with Secure Properties Using MuleSoft Vibes](https://docs.mulesoft.com/anypoint-code-builder/vibes-secure-properties).

## Before You Begin

- [Set up and access Anypoint Code Builder](https://docs.mulesoft.com/anypoint-code-builder/start-acb).

- [Create an integration](https://docs.mulesoft.com/anypoint-code-builder/int-create-integrations).

## Configuration Properties and Encryption

Before following step-by-step procedures for encrypting properties or deploying applications that
use them, learn the basics:

- [Encryption with the MuleSoft Secure Properties Tool](#encryption-tool)

- [Configuration Properties Files](#properties)

- [References to Properties and Property Files in the Configuration XML](#reference-use)

### Encryption with the MuleSoft Secure Properties Tool

To encrypt sensitive data, download the
[Secure Properties Tool Jar file](https://docs.mulesoft.com/mule-runtime/latest/secure-configuration-properties#secure_props_tool).

The tool accepts the following algorithms:

- AES

- Blowfish

- DES

- DESede

- RC2

- RCA

The tool accepts the following ciphers:

- CBC (default)

- CFB

- ECB

- OFB

For step-by-step instructions on encrypting properties in a Mule application, see
[Encrypt Sensitive Values](#encrypt).

### Configuration Properties Files

Connectors and components in the Mule configuration XML accept variables for sensitive and
non-sensitive data. The variables are defined in a `.yaml` or Spring-formatted `.properties` file
that you create and store in the `src/main/resources` directory of the project for your Mule
application, for example:

<table><colgroup><col> <col></colgroup><thead><tr><th>Unencrypted Values for All Keys</th><th>Encrypted Values of <code>uname</code> and <code>pw</code> Keys</th></tr></thead><tbody><tr><td><div><div><div><pre><code data-lang="yaml">ftp:
  workingDir: /Users/me/myworkingdir
  host: localhost
  uname: myusername
  pw: mypassword</code></pre></div></div></div></td><td><div><div><div><pre><code data-lang="yaml">ftp:
  workingDir: /Users/me/myworkingdir
  host: localhost
  uname: "![UqoJI2fvggE=]"
  pw: "![n2LDIOKKxhQ5Tdv5AeCtFQ==]"</code></pre></div></div></div></td></tr></tbody></table>

You can create separate properties files for your unencrypted and encrypted properties, for example,
in a YAML file:

<table><colgroup><col> <col></colgroup><thead><tr><th>Unencrypted Values of <code>workingDir</code> and <code>host</code> Keys</th><th>Encrypted Values of <code>uname</code> and <code>pw</code> Keys</th></tr></thead><tbody><tr><td><div><div><div><code>dev.properties.yaml</code> content:</div><div><pre><code data-lang="yaml">ftp:
  workingDir: /Users/me/myworkingdir
  host: localhost</code></pre></div></div></div></td><td><div><div><div><code>dev.secure.yaml</code> content:</div><div><pre><code data-lang="yaml">ftp:
  uname: "![UqoJI2fvggE=]"
  pw: "![n2LDIOKKxhQ5Tdv5AeCtFQ==]"</code></pre></div></div></div></td></tr></tbody></table>

In a Spring-formatted `.properties` file, the same configurations are:

<table><colgroup><col> <col></colgroup><thead><tr><th>Unencrypted Values of <code>workingDir</code> and <code>host</code> Keys</th><th>Encrypted Values of <code>uname</code> and <code>pw</code> Keys</th></tr></thead><tbody><tr><td><div><div><div><code>dev.properties</code> content:</div><div><pre><code data-lang="properties">ftp.workingDir=/Users/me/myworkingdir
ftp.host=localhost</code></pre></div></div></div></td><td><div><div><div><code>dev.secure.properties</code> content:</div><div><pre><code data-lang="properties">ftp.uname=![UqoJI2fvggE=]
ftp.pw=![n2LDIOKKxhQ5Tdv5AeCtFQ==]</code></pre></div></div></div></td></tr></tbody></table>

For step-by-step instructions, see [Encrypt Sensitive Values](#encrypt).

To provide property settings for different environments, such as production and development
environments, create separate properties files for your environments. For instructions, see
[Provide Settings for Different Environments](#create-prop-file).

> [!TIP] Don’t hardcode production credentials directly in a global element or configuration XML
> file. Instead, reference credentials through a properties file so you can pass the correct
> environment’s values, encrypted where needed, at deployment time.

### References to Properties and Property Files in the Configuration XML

Reference property files and use property values in the configuration XML:

- If your properties file does not contain _any_ encrypted properties:

  - Use this syntax to reference the property value: `${property-key}`

  - Use this global element to reference the file: `<configuration-properties/>`

    For example, assuming that the `port: "8081"` property is in the properties file `ports.yaml`,
    use `${port}` as the value of the `port` attribute in `<http:listener-config/>`:

    ```xml
    <configuration-properties file="ports.yaml"/>

    <http:listener-config name="HTTP_Listener_config" >
      <http:listener-connection host="0.0.0.0" port="${port}" />
    </http:listener-config>
    <flow name="flow" >
      <http:listener doc:name="Listener" config-ref="HTTP_Listener_config" path="/trigger"/>
    </flow>
    ```

- If your properties file contains _any_ encrypted properties:

  - Use this syntax to reference the property value: `${secure::property-key}`

  - Use this global element to reference the file: `<secure-properties:config/>`

    This FTP example references `dev.secure.yaml` with `<secure-properties:config/>`, and uses the
    `secure::` prefix to reference all properties in that properties file:

    ```xml
    <secure-properties:config name="Secure_Properties_Config"
      doc:name="Secure Properties Config" doc:id="acegik"
      file="dev.secure.yaml" key="${encryption.key}" >
          <secure-properties:encrypt algorithm="Blowfish" />
    </secure-properties:config>

    <ftp:config name="FTP_Config" doc:name="FTP Config" doc:id="abcdefg" >
      <ftp:connection workingDir="${secure::ftp.workingDir}" host="${secure::ftp.host}"
        port="21" username="${secure::ftp.uname}" password="${secure::ftp.pw}" />
    </ftp:config>
    <flow>
      ...
    </flow>
    ```

    For step-by-step instructions with encrypted values, see [Use Encrypted Properties](#use).

## Encrypt Sensitive Values

Use the Secure Properties Tool to encrypt sensitive data that you add to properties files for your
Mule application.

Example with properties file `dev.secure.yaml` in the project workspace of a Mule application:

![Project Directory for a Mule Application Workspace](/mulesoft/current/en-us/anypoint-code-builder/_images/acb-project-directory.png)

1.  Create a properties file with _unencrypted_ properties:

    1.  Open the `src/main/resources` directory of your project.

    2.  Create a YAML file with a name like `dev.secure.yaml` or `local.secure.yaml` that configures
        properties as key-value pairs, for example:

        ```yaml
        myprop: "somevalue"

        mysensitiveprop: "mysensitivevalue"
        ```

        For more guidance, see [Configuration Properties Files](#properties).

2.  Encrypt sensitive properties:

    1.  Download the
        [Secure Properties Tool Jar file](https://docs.mulesoft.com/mule-runtime/latest/secure-configuration-properties#secure_props_tool).

    2.  From the command line, run the Secure Properties Tool on the values you intend to secure.

        Example that encrypts `"mysensitivevalue"` using Blowfish and `my-key-value` for an
        encryption key password:

        ```terminal
        $ java -cp secure-properties-tool-j17.jar com.mulesoft.tools.SecurePropertiesTool \
        string \
        encrypt \
        Blowfish \
        CBC \
        my-key-value \
        "mysensitivevalue"
        ```

        Encrypted Output:

        ```terminal
        /MU0/xB/zoMPjxBA7/9X44Ad2H8O8AY5
        ```

        > [!IMPORTANT] Store your encryption key value (password) in a secure location. You’ll need
        > your key value later, when you deploy your application.

        > [!TIP] To verify an encrypted value, decrypt it using the same tool with the `decrypt`
        > command instead of `encrypt`:

        ```terminal
        $ java -cp secure-properties-tool-j17.jar com.mulesoft.tools.SecurePropertiesTool \
        string \
        decrypt \
        Blowfish \
        CBC \
        my-key-value \
        "/MU0/xB/zoMPjxBA7/9X44Ad2H8O8AY5"
        ```

3.  In your properties file, add each encrypted property value within `![]` brackets.

    Example that replaces the unencrypted value `"mysensitivevalue"` with the encrypted value
    `"![/MU0/xB/zoMPjxBA7/9X44Ad2H8O8AY5]"`:

    ```yaml
    myprop: "somevalue"
    mysensitiveprop: "![/MU0/xB/zoMPjxBA7/9X44Ad2H8O8AY5]"
    ```

    For more guidance, see [Configuration Properties Files](#properties).

## Use Encrypted Properties

Add encrypted properties to components in a Mule application. Reference a properties file with
`<secure-properties/>`, and run a local deployment that decrypts your properties.

For reference, the examples shown in the steps in this procedure are based on these configuration
examples:

Configuration XML (`my-secure-integration.xml`)

```xml
<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesoft.org/schema/mule/core" xmlns:doc="http://www.mulesoft.org/schema/mule/documentation"
    xmlns:ee="http://www.mulesoft.org/schema/mule/ee/core"
    xmlns:http="http://www.mulesoft.org/schema/mule/http"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:secure-properties="http://www.mulesoft.org/schema/mule/secure-properties"
    xsi:schemaLocation="http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
    http://www.mulesoft.org/schema/mule/ee/core http://www.mulesoft.org/schema/mule/ee/core/current/mule-ee.xsd
    http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd
	http://www.mulesoft.org/schema/mule/secure-properties http://www.mulesoft.org/schema/mule/secure-properties/current/mule-secure-properties.xsd">

  <secure-properties:config name="Secure_Properties_Config" doc:name="Secure Properties Config" doc:id="utlnst" file="${env}.secure.yaml" key="${encryption.key}" >
    <secure-properties:encrypt algorithm="Blowfish" />
  </secure-properties:config>

  <flow name="my-secure-data-flow" >
    <scheduler doc:name="Scheduler" doc:id="adstdc" >
      <scheduling-strategy>
          <fixed-frequency frequency="15" timeUnit="SECONDS" />
      </scheduling-strategy>
    </scheduler>

    <set-payload value="${secure::myprop}" doc:name="Set payload" doc:id="izdtkc" />
    <logger doc:name="Logger" doc:id="ljjcpz" level="WARN" message="#[payload]" category="INSECURE PROPERTY EXAMPLE" />

    <set-payload value="${secure::mysensitiveprop}" doc:name="Set payload" doc:id="abcdef" />
    <logger doc:name="Logger" doc:id="ghijkl" level="WARN" message="#[payload]" category="SECURE PROPERTY EXAMPLE" />

  </flow>
</mule>
```

Properties file (`dev.secure.yaml`)

The configuration XML uses these properties.

```yaml
myprop: "somevalue"

mysensitiveprop: "![/MU0/xB/zoMPjxBA7/9X44Ad2H8O8AY5]"
```

POM file (`pom.xml`)

The POM file includes dependencies for the components in the configuration XML.

```pom
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.mycompany</groupId>
    <artifactId>my-secure-integration</artifactId>
    <version>1.0.0-SNAPSHOT</version>
    <packaging>mule-application</packaging>

    <name>my-secure-integration</name>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <mule.maven.plugin.version>3.3.5</mule.maven.plugin.version>
    </properties>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.1.0</version>
            </plugin>
            <plugin>
                <groupId>org.mule.tools.maven</groupId>
                <artifactId>mule-maven-plugin</artifactId>
                <version>${mule.maven.plugin.version}</version>
                <extensions>true</extensions>
                <configuration/>
            </plugin>
        </plugins>
    </build>
    <repositories>
        <repository>
            <id>anypoint-exchange-v2</id>
            <name>Anypoint Exchange</name>
            <url>https://maven.anypoint.mulesoft.com/api/v2/maven</url>
            <layout>default</layout>
        </repository>
        <repository>
            <id>mulesoft-releases</id>
            <name>MuleSoft Releases Repository</name>
            <url>https://repository.mulesoft.org/releases/</url>
            <layout>default</layout>
        </repository>
    </repositories>
    <pluginRepositories>
        <pluginRepository>
            <id>mulesoft-releases</id>
            <name>mulesoft release repository</name>
            <layout>default</layout>
            <url>https://repository.mulesoft.org/releases/</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories>
    <dependencies>
        <dependency>
            <groupId>com.mulesoft.services</groupId>
            <artifactId>mule-service-weave-ee</artifactId>
            <version>2.4.0-20221212</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>com.mulesoft.modules</groupId>
            <artifactId>mule-secure-configuration-property-module</artifactId>
            <version>1.2.5</version>
            <classifier>mule-plugin</classifier>
        </dependency>
    </dependencies>
</project>
```

To use an encrypted value in a Mule application:

1.  Before the `<flow/>` element in the configuration XML, add the following Secure Configuration
    Properties configuration (`<secure-properties:config/>`):

    ```xml
    <secure-properties:config name="Secure_Properties_Config"
      doc:name="Secure Properties Config" doc:id="ukvpll"
      file="${env}.secure.yaml" key="${encryption.key}" >
          <secure-properties:encrypt algorithm="Blowfish" />
    </secure-properties:config>

    <flow name="my-secure-data-flow" >
    ...
    ```

2.  Optionally change the `algorithm` attribute to select another algorithm:

    ![List of supported algorithms in Secure Configuration Properties module.](/mulesoft/current/en-us/anypoint-code-builder/_images/int-secure-config-algorithms.png)

3.  Configure the element with values for the `file`, `key`, and `algorithm` attributes, for
    example:

    ```xml
    <secure-properties:config name="Secure_Properties_Config"
      doc:name="Secure Properties Config" doc:id="ddzpxf"
      file="dev.secure.yaml" key="${encryption.key}" >
       <secure-properties:encrypt algorithm="Blowfish" />
    </secure-properties:config>
    ```

    - `file`: Name of your properties file

      If you want to use the variable `${env}` in your filename configuration, see
      [Provide Settings for Different Environments](#create-prop-file) for the procedure.

    - `name`: A name of your choice for the encryption key (defaults to `${encryption.key}`)

      This name serves as the key for the encryption value (password) used to encrypt your secure
      properties with the Secure Properties Tool.

    - `algorithm`: Algorithm you used to encrypt your secure properties (defaults to Blowfish in the
      previous example). Other [algorithms](#algorithms) are available.

4.  In the connector or component XML, add the key of an encrypted property as the value of an XML
    attribute, for example:

    ```xml
    <set-payload
      value="${secure::mysensitiveprop}"
      doc:name="Set payload" doc:id="abcdef" />
    ```

    Notice the `secure::` prefix to the key.

## Edit Secure Properties Configuration via Global Elements

Add, edit, or delete a secure properties configuration from **Global Elements**. To add one, click
**New Configuration** and select the secure properties type. To delete one, click the **More
actions** (**…​**) menu next to the element and select **Delete**.

To edit the secure properties configuration:

1.  Open **Project Properties** > **Global Elements**.

    ![Global Elements with a list of configurations including Secure Properties Config.](/mulesoft/current/en-us/anypoint-code-builder/_images/int-global-elements-panel-list.png)

2.  Select **global-configs.xml** from the **Selected File** dropdown.

3.  Find **Secure Properties Config** in the list.

4.  Click **More actions** (**…​**) in the configuration name.

5.  Click **Edit**.

The editor opens and you can modify these fields.

![Form editor showing configurable fields for Secure Properties Config.](/mulesoft/current/en-us/anypoint-code-builder/_images/int-secure-properties-form-editor.png)

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Example Value</th><th>What It Controls</th></tr></thead><tbody><tr><td><div><div><p><strong>Name</strong></p></div></div></td><td><div><div><p>Secure_Properties_Config</p></div></div></td><td><div><div><p>Element name referenced internally</p></div></div></td></tr><tr><td><div><div><p><strong>File</strong></p></div></div></td><td><div><div><p>$site.secure.properties</p></div></div></td><td><div><div><p>Which encrypted file to load (resolves per environment)</p></div></div></td></tr><tr><td><div><div><p><strong>Key</strong></p></div></div></td><td><div><div><p>${encryption.key}</p></div></div></td><td><div><div><p>The decryption key placeholder (resolved from system property)</p></div></div></td></tr><tr><td><div><div><p><strong>Algorithm</strong></p></div></div></td><td><div><div><p>AES</p></div></div></td><td><div><div><p>Encryption algorithm (AES, Blowfish, DES, DESede, RC2)</p></div></div></td></tr><tr><td><div><div><p><strong>Mode</strong></p></div></div></td><td><div><div><p>CBC</p></div></div></td><td><div><div><p>Cipher mode (CBC, CFB, ECB, OFB)</p></div></div></td></tr></tbody></table>

Changes you make in the editor automatically update the XML in `global-configs.xml`.

The editor manages the configuration element. To change the actual encrypted values in
`.secure.properties` files, use the secure-properties-tool JAR, edit the file directly, or ask
MuleSoft Vibes to re-encrypt values. See
[Working with Secure Properties Using MuleSoft Vibes](https://docs.mulesoft.com/anypoint-code-builder/vibes-secure-properties).

## Test Encrypted Properties in Anypoint Code Builder

If your application uses encrypted properties, add arguments for the encryption key and value to the
runtime command. Adding these arguments to the setting enables the runtime to decrypt properties
used in your application so that it deploys successfully to the local runtime.

The setting avoids an error that causes the deployment to fail when you use **Run and Debug**:

Couldn't find configuration property value for key ${encryption.key} from properties provider
environment properties provider

1.  Provide a local key-value pair for your encryption key name and its value through the UI:

    1.  Navigate to **Manage** (gear icon) > **Settings**, and find **Runtime: Default Arguments**
        on the **Settings** page.

    2.  In the **Runtime: Default Arguments** field, append the key-value pair for your encryption
        key to the _end_ of the configuration, for example:

        ```key-configuration
        -M-Dencryption.key=my-key-value
        ```

        In the example, `-M-D` is the required prefix, `encryption.key` is the default name of the
        encryption key, and `my-key-value` is the value used to encrypt the properties through the
        Secure Properties Tool.

    3.  If you are using a variable such as `${env}` in `${env}.secure.yaml` to identify the
        properties file in `<secure-properties:config/>`, append a value for `${env}` to the
        **Runtime: Default Arguments** field.

        For example, for a file `dev.secure.yaml` that contains properties for the development
        environment:

        ```env-configuration
        -M-Denv=dev
        ```

2.  Deploy the application locally by pressing Cmd+shift+p (Mac) or Ctrl+shift+p (Windows), and
    entering **View: Show Run and Debug**, then clicking **Run and Debug**.

    A successful deployment produces the following message in the **OUTPUT** tab of the output
    panel:

    \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
    \* - - + DOMAIN + - - \* - - + STATUS + - - \*
    \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
    \* default \* DEPLOYED \*
    \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

    For information about the output panel, see [Viewing Logs and Errors](https://docs.mulesoft.com/anypoint-code-builder/start-open-output-panel).

    If the application does not deploy successfully, check the console for the error and
    troubleshoot.

3.  If you intend to deploy your application to CloudHub or CloudHub 2.0, proceed to
    [Deploy to CloudHub and CloudHub 2.0 with Sensitive Values Hidden](#deploy-to-cloudhub).

    This procedure shows how to hide the encryption key value in Runtime Manager.

## Deploy to CloudHub and CloudHub 2.0 with Sensitive Values Hidden

When you deploy an application that you build with Anypoint Code Builder to CloudHub or CloudHub
2.0, hide the value of your encryption key to prevent Runtime Manager UI from displaying the value
(see [Manage Properties for Applications on CloudHub](https://docs.mulesoft.com/cloudhub/cloudhub-manage-props)).

Runtime Manager serves as the management console for CloudHub and CloudHub 2.0 deployments. The
encryption key value serves as the password for encryption and decryption.

> [!IMPORTANT] This procedure configures the _name_ of your encryption key but not its value in
> `mule-artifact.json`. For security, never configure the _value_ of your encryption key in this or
> any other file that is packaged within a deployed project.

Before you begin:

- Run and test encrypted properties used by your Mule application. See
  [Configuration Properties Files](#properties) for guidance.

To hide sensitive values from the Runtime Manager UI when you deploy to CloudHub or CloudHub 2.0:

1.  In the `mule-artifact.json` file for your application, provide the _name_ of the encryption key
    (`encryption.key` by default) that you provided in the global `<secure-properties:config/>`
    element within your configuration XML, for example:

    { "minMuleVersion": "4.8", "javaSpecificationVersions": \[ "17" \], "secureProperties":
    \["encryption.key", "other.value.to.hide"\] }

    The _name_ (not the _value_) of your encryption key goes into a comma-separated
    `secureProperties` array. Later in this procedure, when you deploy your application to CloudHub,
    Anypoint Code Builder prompts you to provide the _value_ of the encryption key that you provided
    through the Secure Configuration Tool when encrypting your sensitive properties.

2.  Deploy your application to CloudHub or CloudHub 2.0 by pressing Cmd+shift+p (Mac) or
    Ctrl+shift+p (Windows) and providing this command:

    ```command
    MuleSoft: Deploy to CloudHub
    ```

    Alternatively, click the **Deploy to CloudHub** (rocket) icon when your configuration XML file
    is open, for example:

    ![Deploy to CloudHub rocket icon](/mulesoft/current/en-us/anypoint-code-builder/_images/deploy-to-cloudhub-icon-with-detail.png)

3.  When prompted, enter _the same value_ you used to encrypt your secure properties.

    If you do not enter the same value, the application is able to upload to CloudHub or CloudHub
    2.0, but the deployment fails because the encryption key value does not work.

4.  Select the **Sandbox** environment for your deployment.

    Other environments are not supported, and attempts to deploy to the **Design** environment fail
    with a `500` error code. While the deployment is in progress, Anypoint Code Builder provides the
    status of the process and prompts you to open the application in Runtime Manager when the
    deployment completes.

    If you receive an error message that says the application
    `was not successfully deployed to "Sandbox" in CloudHub`, you can open Runtime Manager to check
    the logs and correct some issues.

5.  Click **Open in Runtime Manager** to open the management options for the application in Runtime
    Manager.

6.  Check the deployment in Runtime Manager to ensure that the encryption key is hidden by
    navigating to **Settings** > **Properties** for your application.

7.  In the **Applications** screen for the **SANDBOX** environment, check the **Status** field for
    your application:

    - If the status is **Started**, the deployment is successful, and the application is running.

    - If the status is **Deploy failed**, click the name of your application, and navigate to
      **Logs** to discover the cause of the failure.

      If the encryption key value is wrong, the error is
      `org.mule.encryption.exception.MuleEncryptionException: Could not encrypt or decrypt the data.`

      To fix this error:

      1.  Navigate to **Settings** > **Properties** for your application in Runtime Manager and
          provide the correct value for your encryption key in the field for the encryption key.

      2.  Click **Apply Changes**.

          Runtime Manager applies your changes and attempts to deploy your application.

For more information, see [Anypoint Runtime Manager](https://docs.mulesoft.com/runtime-manager/). For information about
CloudHub, see [CloudHub Overview](https://docs.mulesoft.com/cloudhub/). For information about CloudHub 2.0, see
[CloudHub 2.0 Overview](https://docs.mulesoft.com/cloudhub-2/)

## Provide Settings for Different Environments

Hosts, ports, directories, and other settings in the configuration XML often differ depending on the
target environment for your deployment, such as the development, sandbox, or production environment.
For example, on your desktop, the host name is typically `localhost`, the port something like
`8081`, and the directory is a path on your local machine rather than a path to an external host.

When developing your application, create separate properties files for each of the target
environments that require different settings, and provide the appropriate settings in each file.

Typical filenames follow patterns like these:

- `dev.properties.yaml` or `dev.secure.yaml` for your development environment

- `sandbox.properties.yaml` or `sandbox.secure.yaml` for a pre-production environment

- `prod.properties.yaml` or `prod.secure.yaml` for the production environment

Consistent filename patterns enable you to use a `${env}` variable in your configuration XML for the
prefix to the filename, for example, `${env}.properties.yaml` or `${env}.secure.yaml`. This pattern
enables you to switch to the file that contains settings for the environment in which your
application runs. You can include encrypted and unencrypted property values in the files.

To configure and use the `env` variable as a prefix to a filename:

1.  Using a consistent filename pattern, create properties files for each environment that requires
    different settings.

2.  If you are using the `<secure-properties/>` or another element that points to your properties
    file, provide a prefix, such as `${env}`, to the file name.

    Notice the value of the `file` attribute in this example:

    ```xml
    <secure-properties:config name="Secure_Properties_Config"
      doc:name="Secure Properties Config" doc:id="acegik"
      file="${env}.secure.yaml" key="${encryption.key}" >
          <secure-properties:encrypt algorithm="Blowfish" />
    </secure-properties:config>
    ```

3.  _Before deploying to CloudHub or CloudHub 2.0_, ensure that the application deploys locally:

    1.  Press Cmd+shift+p (Mac) or Ctrl+shift+p (Windows), and provide this command:

        ```command
        Open 'launch.json'
        ```

    2.  In `launch.json`, append the value of the `env` variable to use when running the
        application.

        Notice the setting `-M-Denv=dev` in this `launch.json` example. For more information about
        launch configurations and alternative methods for passing properties, see
        [Pass Runtime Properties and Arguments to Mule Applications](https://docs.mulesoft.com/anypoint-code-builder/int-run-mule-apps-with-properties).

        ```json
        {
          "version": "0.2.0",
          "configurations": [
            {
              "type": "mule-xml-debugger",
              "request": "launch",
              "name": "Debug Mule Application",
              "mule.project": "${workspaceFolder}",
              "mule.home": "${config:mule.homeDirectory}",
              "mule.runtime.args": "${config:mule.runtime.defaultArguments} -M-Denv=dev"
            }
          ]
        }
        ```

        `-M-Denv=dev` sets the `env` variable to `dev` as a Mule runtime argument
        (`"mule.runtime.args"`).

    3.  If your application defines encrypted properties in your properties file, configure the
        **Runtime: Default Arguments** command with the encryption key and value so that the local
        deployment can decrypt the properties when the application runs.

        _Do not_ configure `launch.json` with sensitive property values. See
        [Test Encrypted Properties in Anypoint Code Builder](#test-deploy) for guidance with the
        recommended configuration.

4.  Launch the `deploy.json` file for your application by pressing Cmd+shift+p (Mac) or Ctrl+shift+p
    (Windows) and providing this command:

    ```command
    MuleSoft: Deploy to CloudHub
    ```

    Alternatively, click the **Deploy to CloudHub** (rocket) icon when your configuration XML file
    is open, for example:

    ![Deploy to CloudHub rocket icon with deploy.json open](/mulesoft/current/en-us/anypoint-code-builder/_images/deploy-to-cloudhub-icon-with-deploy-json.png)

5.  _Before opting to deploy_, edit `deploy.json` to specify the correct prefix to your properties
    file, for example:

    ```deploy.json
    {
      "runtime": "4.4.0",
      "workerSize": 0.1,
      "applicationName": "my-secure-int2-duke",
      "workers": 1,
      "autoStart": true,
      "properties": (1)
        {
          "env": "sandbox" (2)
        }
    }
    ```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>Add the <code>"properties"</code> key.</td></tr><tr><td><i data-value="2"></i><b>2</b></td><td>Add an object that specifies the value of the <code>${env}</code> prefix to your properties file, such as <code>sandbox</code>.</td></tr></tbody></table>

6.  If prompted, enter _the same value_ you used to encrypt your secure properties.

7.  Select the **Sandbox** environment for your deployment.

8.  Once the deployment is complete, click **Open in Runtime Manager** to open the management
    options for the application in Runtime Manager.

9.  To check for properties such as your `env` setting or a hidden value to your encryption key,
    click **Settings** > **Properties** for your application.

    You can create properties or change the value of existing properties, for example, to fix some
    deployment errors.

## Quick Reference

Use this table for quick access to common secure properties tasks and commands:

<table><colgroup><col> <col></colgroup><thead><tr><th>Task</th><th>Command / Location</th></tr></thead><tbody><tr><td><div><div><p>Encrypt a value</p></div></div></td><td><div><div><p><code>java -cp secure-properties-tool-j17.jar com.mulesoft.tools.SecurePropertiesTool string encrypt AES CBC &lt;key&gt; &lt;value&gt;</code></p></div></div></td></tr><tr><td><div><div><p>Decrypt a value</p></div></div></td><td><div><div><p><code>java -cp secure-properties-tool-j17.jar com.mulesoft.tools.SecurePropertiesTool string decrypt AES CBC &lt;key&gt; &lt;encrypted-value&gt;</code></p></div></div></td></tr><tr><td><div><div><p>Reference encrypted property in XML</p></div></div></td><td><div><div><p><code>${secure::property.name}</code></p></div></div></td></tr><tr><td><div><div><p>Reference non-encrypted property in XML</p></div></div></td><td><div><div><p><code>${property.name}</code></p></div></div></td></tr><tr><td><div><div><p>Secure properties config element</p></div></div></td><td><div><div><p><code>&lt;secure-properties:config file="$site.secure.properties" key="${encryption.key}"&gt;</code></p></div></div></td></tr><tr><td><div><div><p>Pass encryption key locally</p></div></div></td><td><div><div><p>Add <code>-M-Dencryption.key=YourKey</code> to <code>mule.runtime.args</code> in <code>launch.json</code></p></div></div></td></tr><tr><td><div><div><p>Pass encryption key in CloudHub</p></div></div></td><td><div><div><p>Add to Properties tab in Runtime Manager: <code>encryption.key=YourKey</code></p></div></div></td></tr><tr><td><div><div><p>Switch environment</p></div></div></td><td><div><div><p>Pass <code>-M-Denv=qa</code> or <code>-M-Denv=prod</code> as runtime argument</p></div></div></td></tr><tr><td><div><div><p>Hide encryption key in CloudHub</p></div></div></td><td><div><div><p>Add encryption key name to <code>secureProperties</code> array in <code>mule-artifact.json</code></p></div></div></td></tr></tbody></table>

## See Also

- [Working with Secure Properties Using MuleSoft Vibes](https://docs.mulesoft.com/anypoint-code-builder/vibes-secure-properties)

- [Managing Global Configuration Elements](https://docs.mulesoft.com/anypoint-code-builder/int-global-config-elements)

- [Pass Runtime Properties and Arguments to Mule Applications](https://docs.mulesoft.com/anypoint-code-builder/int-run-mule-apps-with-properties)

- [Launch Configuration Properties Reference](https://docs.mulesoft.com/anypoint-code-builder/ref-launch-json-properties)

- [Secure Configuration Properties](https://docs.mulesoft.com/mule-runtime/latest/secure-configuration-properties)