How it works
Where a Function's credential comes from, how it reaches your code, and when it stops working.
Gigadrive Network mints one OAuth 2.0 credential per Function while the deployment is being provisioned, then delivers it to the Function as environment variables. Nowhere in that path does anyone copy a secret.
Minting
A deployment produces one or more Functions, and each one is issued an API key: the client id is the key's UUID, the client secret is a gdnet_secret_ string. The key names the Function, its deployment, and the application, and those bindings are what the API later uses to decide what a token may touch. Its scopes are the same seven on every Function, listed in Function scopes.
Delivery
The pair arrives as GIGADRIVE_CLIENT_ID and GIGADRIVE_CLIENT_SECRET, next to GIGADRIVE_APPLICATION_ID, GIGADRIVE_DEPLOYMENT_ID, and GIGADRIVE_URL. Injected variables lists all of them.
The values are handed over when the Function starts, not written into your build output. That matters: a secret baked into a build artifact travels with every copy of that artifact and outlives the deployment it belonged to.
Exchanging it for a token
The credential is not a bearer token. Code posts it to /oauth2/token, gets back an access token valid for 300 seconds, and sends that token as Authorization: Bearer on API calls.
The SDK does this on the first call and caches the token until shortly before it expires. OIDC provider has the request and response shapes.
Rotation and revocation
There is no rotate button, and no way to revoke one Function's credential while that Function is serving traffic. Revoking it would break the deployment. The credential's lifetime is the Function's instead: when the deployment's Functions are removed, the credential goes with them.
For the same reason, these keys are hidden from key management. They do not appear in GET /api-keys, and DELETE /api-keys/{apiKeyId} answers 404 for one.
Redeploying does not rotate anything either. A new deployment creates new Functions, and each of those is minted a fresh credential, while the old deployment keeps its own for as long as it exists. When a credential does go away it stops working at once, and so do the access tokens already minted from it.