From 7253308ce72fc192c6e264bca46f0b9880e4062a Mon Sep 17 00:00:00 2001
From: geoffg-sentry <165922362+geoffg-sentry@users.noreply.github.com>
Date: Thu, 10 Sep 2026 11:25:17 -0400
Subject: [PATCH 1/2] Update self-hosted to clarify LAUNCHPAD_RPC_SHARED_SECRET

Improving the explanation around how the LAUNCHPAD_RPC_SHARED_SECRET is used. This is more accurate on how the secret is shared among services.
---
 develop-docs/self-hosted/configuration/index.mdx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/develop-docs/self-hosted/configuration/index.mdx b/develop-docs/self-hosted/configuration/index.mdx
index 24bb86700cfed..c296c420bdee0 100644
--- a/develop-docs/self-hosted/configuration/index.mdx
+++ b/develop-docs/self-hosted/configuration/index.mdx
@@ -35,12 +35,12 @@ You can find more about configuring Sentry at [the configuration section of our
 
 Sentry comes with a cleanup cron job that prunes events older than `90 days` by default. If you want to change that, you can edit the `SENTRY_EVENT_RETENTION_DAYS` environment variable in `.env` or simply override it in your environment.
 
-### Internal RPC Shared Secret
+### Launchpad RPC shared secret
 
-The `taskbroker` and `launchpad` services authenticate internal RPC calls to each other using the `LAUNCHPAD_RPC_SHARED_SECRET` environment variable. This ships with a hardcoded default in `.env` that's fine for local testing but too weak for production.
+`LAUNCHPAD_RPC_SHARED_SECRET` is shared by the `launchpad` and `web` services. Launchpad uses it to HMAC its HTTP calls to `web`. It is not the credential for Launchpad's gRPC connection to `taskbroker`. It ships with a hardcoded default in `.env` that is fine for local testing but too weak for production.
 
 <Alert title="Warning" level="warning">
-  Override <code>LAUNCHPAD_RPC_SHARED_SECRET</code> in your <code>.env.custom</code> file with a strong, randomly generated value to secure internal communication between the <code>taskbroker</code> and <code>launchpad</code> services.
+  Set a unique random <code>LAUNCHPAD_RPC_SHARED_SECRET</code> in <code>.env.custom</code>. Treat it like <code>system.secret-key</code>: it must be unique to this install.
 </Alert>
 
 ### Installing a specific SHA

From 0e594a5a9e064cfbdae16a20c68cace451df8303 Mon Sep 17 00:00:00 2001
From: geoffg-sentry <165922362+geoffg-sentry@users.noreply.github.com>
Date: Thu, 10 Sep 2026 12:12:30 -0400
Subject: [PATCH 2/2] clarification

---
 develop-docs/self-hosted/configuration/index.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/develop-docs/self-hosted/configuration/index.mdx b/develop-docs/self-hosted/configuration/index.mdx
index c296c420bdee0..5069a19edfa57 100644
--- a/develop-docs/self-hosted/configuration/index.mdx
+++ b/develop-docs/self-hosted/configuration/index.mdx
@@ -37,7 +37,7 @@ Sentry comes with a cleanup cron job that prunes events older than `90 days` by
 
 ### Launchpad RPC shared secret
 
-`LAUNCHPAD_RPC_SHARED_SECRET` is shared by the `launchpad` and `web` services. Launchpad uses it to HMAC its HTTP calls to `web`. It is not the credential for Launchpad's gRPC connection to `taskbroker`. It ships with a hardcoded default in `.env` that is fine for local testing but too weak for production.
+`LAUNCHPAD_RPC_SHARED_SECRET` is shared by the `launchpad-taskworker` and `web` services. Launchpad uses it to HMAC its HTTP calls to `web`. It is not the credential for Launchpad's gRPC connection to `taskbroker`. It ships with a hardcoded default in `.env` that is fine for local testing but too weak for production.
 
 <Alert title="Warning" level="warning">
   Set a unique random <code>LAUNCHPAD_RPC_SHARED_SECRET</code> in <code>.env.custom</code>. Treat it like <code>system.secret-key</code>: it must be unique to this install.