Skip to main content

Secrets

Secrets is a per-project vault for the credentials your agents need to do their work: API keys, tokens, and similar values. It lives at Manage → Secrets and always acts on whichever project you have selected.

Values are encrypted, and they are never shown by default. You have to deliberately reveal one to see it. A revealed value only lives in your browser's memory for that session; it is never persisted.

Each secret has:

  • Key: the name your agents reference it by.
  • Value: the actual credential, encrypted at rest.
  • Description (optional): what it is for.

How do I add a secret?​

  1. Click New secret.
  2. Enter a Key (must start with a letter, and contain only letters, digits, and underscores, for example MY_API_KEY).
  3. Enter the Value.
  4. Optionally add a Description.
  5. Click Create secret.

Viewing a secret's value​

  1. Click the eye icon next to the value in the table.
  2. Click it again (it becomes a crossed-out eye) to hide it.

Revealing is per-secret and toggles independently; you do not reveal the whole list at once.

How do I rotate or edit a secret?​

  1. Click the pencil icon on its row.
  2. To change the value, type a new one. Leave it blank to keep the current value unchanged.
  3. Update the description if you need to.
  4. Click Save changes.

The key itself can never be changed once a secret is created; delete it and create a new one under a different key if you need to rename it.

Deleting a secret​

  1. Click the trash icon on its row.
  2. Confirm in the dialog.

This is permanent and immediate; anything relying on that secret stops working the moment it is gone.

When does the page go read-only?​

If you do not have secret management access, or the project is not in a normal active state (still provisioning, degraded, or archived), the list stays visible but every action control disappears; you can see which keys exist and their descriptions, just not reveal, edit, or delete anything.

Who can do this: Viewing the list of keys and descriptions needs read access to secrets (secret:read). Adding, revealing values, rotating, and deleting all need secret management access (secret:manage), and only while the project is active and mutable. Set both per member in Settings → Workspace → People & access; see the People and access guide.

How this connects to the rest of the platform​

  • Used by reference. Any part of the platform that needs a credential reads it from this vault by reference. A raw secret value is never exposed or stored elsewhere; the value stays in the vault and is injected only where it is needed.
On this page