Skip to main content

Secrets

Secrets is a per-project vault for the credentials your agents need to do their work: API keys, tokens, and similar values. It lives at Manage → Secrets (/manage/secrets) and always acts on whichever project you have selected.

Values are encrypted, and they are never shown by default. You have to deliberately reveal one to see it. A revealed value only lives in your browser's memory for that session; it is never persisted.

Each secret has:

  • Key: the name your agents reference it by.
  • Value: the actual credential, encrypted at rest.
  • Description (optional): what it is for.

How do I add a secret?​

  1. Click New secret.
  2. Enter a Key (must start with a letter, and contain only letters, digits, and underscores, for example MY_API_KEY).
  3. Enter the Value.
  4. Optionally add a Description.
  5. Click Create secret.

Viewing a secret's value​

  1. Click the eye icon next to the value in the table.
  2. Click it again (it becomes a crossed-out eye) to hide it.

Revealing is per-secret and toggles independently; you do not reveal the whole list at once.

How do I rotate or edit a secret?​

  1. Click the pencil icon on its row.
  2. To change the value, type a new one. Leave it blank to keep the current value unchanged.
  3. Update the description if you need to.
  4. Click Save changes.

The key itself can never be changed once a secret is created; delete it and create a new one under a different key if you need to rename it.

Deleting a secret​

  1. Click the trash icon on its row.
  2. Confirm in the dialog.

This is permanent and immediate; anything relying on that secret (an agent, a connected MCP server) stops working the moment it is gone.

When does the page go read-only?​

If you do not have secret management access, or the project is not in a normal active state (still provisioning, degraded, or archived), the list stays visible but every action control disappears; you can see which keys exist and their descriptions, just not reveal, edit, or delete anything.

Who can do this: Viewing the list of keys and descriptions needs read access to secrets (secret:read). Adding, revealing values, rotating, and deleting all need secret management access (secret:manage), and only while the project is active and mutable. Set both per member in Settings → Workspace → People & access; see the People and access guide.

How this connects to the rest of the platform​

  • MCP servers. When you connect a custom MCP server from the Agents page and it needs to authenticate, its auth reference points at a key you have already created here. See MCP servers.
  • Agents generally. Any tool that needs a credential (a custom tool, an MCP server) reads it from this vault by reference. Agents never see or store a raw secret value in their own configuration; the value stays in the vault and is injected only where it is needed.
On this page