Secrets

Secrets hold the API keys and account tokens that code and Integrations use. The platform fills each value in at call time, so no agent or caller ever reads it.

ContractCopy Anchor Link

• A secret's value is write-only. A caller stores it, and no read returns it, the owner's included.
• The platform fills the value into the outgoing request, browser form or webhook signature check, so no model sees it.
• Every use is an Event naming the secret, the Action and the upstream it reached.
• A secret is scoped to the Studio, a Startup, a Tenant or a Channel.
• Rotation writes a new version and keeps every old one, marked retired. A schedule reminds the owner Role every 90 days.
• Revoking a secret takes effect on the next call.
• Roles with read see names. No Role sees values.
• Deploy pipelines exchange their own identity token for a short-lived key, so they store no secret at all.

VerbsCopy Anchor Link

InterfacesCopy Anchor Link

• API
• SDK
• CLI
• MCP

ExampleCopy Anchor Link

// A travel-deals newsletter stored its affiliate network key once, as AFFILIATE_KEY.
// Its Function calls the network by name; the platform fills in the key at call time.
const deals = await fetch('https://affiliates.example/v2/deals', {
  headers: { Authorization: 'Bearer {{secret:AFFILIATE_KEY}}' },
})