A secret is a named value — an API key, a token — stored encrypted. Your tools reference it by name, so the key itself never sits in a URL or a header you can read off the screen.
Two reasons this matters: anyone who can see your tool setup would otherwise see your keys, and when a key rotates you change it in one place instead of hunting through every tool.
Before you start
- Have the key or token to hand. You will not be able to read it back afterwards.
- Create the secret before the tool that needs it — though you can also create one from inside the tool form with Create new secret.
Steps
- 1
Create a secret
Click Create. Give it a Name you will recognise in a dropdown later — Stripe live key, not key1 — and paste the key into Value.
The value is stored encrypted and is never shown again. Keep your own copy somewhere safe before you save.
The create secret form - 2
Reference it from a tool
In a webhook tool's headers, pick the secret from the Secret dropdown instead of typing the key. The agent resolves it at call time.
Selecting a secret in a tool - 3
Check the list
The list shows Name and Created At — never the value.
When a key rotates, edit the secret and save the new value. Every tool referencing it follows automatically — no tool edits needed.
The secrets list
Good to know
- One secret per key. Sharing one secret across unrelated services means rotating one forces you to think about all of them.
- Deleting a secret breaks any tool referencing it, and the failure shows up as a tool error in the transcript rather than an obvious warning.
- Secrets are per account, so your whole team's tools can use the same one.