Q:

What is the actual use of Secret Key?

I play framework's documentation I found this about "secret key"

Play uses a secret key for a number of things, including:
*Signing session cookies and CSRF tokens 
*Built in encryption utilities

I can understand why they are using secret key for these things. But I can't understand why do I have to assign such a thing. Why don't they use a random number or something like that to do the job? (When I use playGenerateSecret command in the play console I think they are giving me a randomly generated key) 
After deploying my application with a secret key, do I ever need that again to use?

A:

The reason that they do not generate a secret is because it would defeat the purpose. If you are, e.g., deploying your application with Ansible, you can have your secret stored in a vault-encrypted file, and then have an environment variable set for the duration of the Ansible play that reads the encrypted secret. Then, the Ansible play should build the artifact locally and upload it to the remote server. In this way, the server that you are deploying to never actually has any knowledge of the application secret!

