Domains, API clients, backups, integrations, and asynchronous operations
Domains
Domains are added/removed/set-primary through scoped procedures. DNS/SSL verification can run asynchronously.
API clients
The backend generates high-entropy secrets, stores only safe derived data such as hashes where appropriate, and displays the raw secret once. Rotate/revoke operations are audited.
Backups
A backup request creates pending work. A worker executes it and updates status. Backup destinations are managed through scoped procedures and should avoid long-lived plaintext cloud credentials.
Integrations
Sensitive integration secrets are encrypted before database persistence and omitted from list/detail responses.
General rule
Long-running infrastructure actions should expose queued/provisioning/running/failed states and correlation IDs rather than block an interactive browser request.