# Secrets

URL: /code/platform/secrets · Id: `capability:secrets`

> Secrets hold keys and outside credentials, scoped, rotated and audited, injected at call time and never shown to agents.

[Secrets](/business/nouns/secret) hold the API keys and account tokens that code and [Integrations](/business/nouns/integration) use. The platform fills each value in at call time, so no agent or caller ever reads it.

## Contract
- A secret's value is write-only. A caller stores it, and no read returns it, the owner's included.
- The platform fills the value into the outgoing request, browser form or webhook signature check, so no model sees it.
- Every use is an [Event](/business/nouns/event) naming the secret, the [Action](/business/nouns/action) and the upstream it reached.
- A secret is scoped to the [Studio](/business/nouns/studio), a [Startup](/business/nouns/startup), a [Tenant](/business/nouns/tenant) or a [Channel](/business/nouns/channel).
- Rotation writes a new version and keeps every old one, marked retired. A schedule reminds the owner [Role](/business/nouns/role) every 90 days.
- Revoking a secret takes effect on the next call.
- Roles with read see names. No Role sees values.
- Deploy pipelines exchange their own identity token for a short-lived key, so they store no secret at all.

## Verbs
| Verb | Object | Event |
| --- | --- | --- |
| [Secret.store](/business/nouns/secret/store) | [Secret](/business/nouns/secret) | [`Secret.stored`](/business/events/Secret.stored) |
| [Secret.rotate](/business/nouns/secret/rotate) | [Secret](/business/nouns/secret) | [`Secret.rotated`](/business/events/Secret.rotated) |
| [Secret.revoke](/business/nouns/secret/revoke) | [Secret](/business/nouns/secret) | [`Secret.revoked`](/business/events/Secret.revoked) |
| [Secret.list](/business/nouns/secret/list) | [Secret](/business/nouns/secret) | None. |

## Interfaces
- [API](/code/api/reference)
- [SDK](/code/sdk/reference)
- [CLI](/code/cli/reference)
- [MCP](/code/mcp/reference)

## Example
```ts
// A travel-deals newsletter stored its affiliate network key once, as AFFILIATE_KEY.
// Its Function calls the network by name; the platform fills in the key at call time.
const deals = await fetch('https://affiliates.example/v2/deals', {
  headers: { Authorization: 'Bearer {{secret:AFFILIATE_KEY}}' },
})
```