@Override public void init(final Configuration conf) {
    char[] sharedSecret;
    byte[] sharedSecretBytes = null;

    // try getting secret from conf first
    // if not found, get from env var - LLAP_EXTERNAL_CLIENT_CLOUD_JWT_SHARED_SECRET_ENV_VAR
    try {
      sharedSecret = conf.getPassword(LLAP_EXTERNAL_CLIENT_CLOUD_JWT_SHARED_SECRET.varname);
    } catch (IOException e) {
      throw new RuntimeException("Unable to get password [hive.llap.external.client.cloud.jwt.shared.secret] - "
          + e.getMessage(), e);
    }
    if (sharedSecret != null) {
      ByteBuffer bb = StandardCharsets.UTF_8.encode(CharBuffer.wrap(sharedSecret));
      sharedSecretBytes = new byte[bb.remaining()];
      bb.get(sharedSecretBytes);
    } else {
      String sharedSecredFromEnv = System.getenv(LLAP_EXTERNAL_CLIENT_CLOUD_JWT_SHARED_SECRET_ENV_VAR);
      if (StringUtils.isNotBlank(sharedSecredFromEnv)) {
        sharedSecretBytes = sharedSecredFromEnv.getBytes();
      }
    }

    Preconditions.checkState(sharedSecretBytes != null,
        "With: " + LLAP_EXTERNAL_CLIENT_CLOUD_DEPLOYMENT_SETUP_ENABLED.varname + " = true, \n"
            + "To use: org.apache.hadoop.hive.llap.security.DefaultJwtSharedSecretProvider, \n"
            + "1. a non-null value of 'hive.llap.external.client.cloud.jwt.shared.secret' must be provided OR \n"
            + "2. alternatively environment variable "
            + "LLAP_EXTERNAL_CLIENT_CLOUD_JWT_SHARED_SECRET_ENV_VAR can also be set. \n"
            + "Length of the secret provided in 1) or 2) should be > 32 bytes.");

    this.jwtEncryptionKey = Keys.hmacShaKeyFor(sharedSecretBytes);
  }
Default implementation of {@link JwtSecretProvider}.

1. It first tries to get shared secret from conf {@link HiveConf.ConfVars#LLAP_EXTERNAL_CLIENT_CLOUD_JWT_SHARED_SECRET}
using {@link Configuration#getPassword(String)}.

2. If not found, it tries to read from env var {@link #LLAP_EXTERNAL_CLIENT_CLOUD_JWT_SHARED_SECRET_ENV_VAR}.

If secret is not found even after 1) and 2), {@link #init(Configuration)} methods throws {@link IllegalStateException}.

Length of shared secret provided in 1) or 2) should be &gt; 32 bytes.

It uses the same encryption and decryption secret which can be used to sign and verify JWT.
llap-common/src/java/org/apache/hadoop/hive/llap/security/DefaultJwtSharedSecretProvider.java