Secrets vault

Some agent jobs need credentials — an API key for an insurer's portal, a token for an internal service. The Secrets vault stores them so agents can use them without anyone, the agent included, ever seeing the value.

How secrets work#

Open Settings → Secrets and choose Add secret. A secret is an environment value that agents can use inside their code sandboxes.

• Write-only. You can set, rotate and delete a secret, but never read its value back — not in the console, not through the API.
• Names, not values. Agents see a secret's name and use it in their sandbox; they never see what's inside it.
• Redacted output. If a value would appear in an agent's output, it's redacted.

Choosing which agents can use a secret#

Each secret has an access setting:

Prefer selected agents. A claims portal key belongs to the claims assistant, not to every agent in the workspace.

Rotating#

When a credential changes, or someone who knew it leaves, rotate it: update the value in place and every agent that uses it picks up the new one. You can also change a secret's description or its agent access without touching the value.

Through the API#

Secrets live under /docs/api/secrets:

• GET /secrets lists names and metadata — values are never returned;
• POST /secrets creates one;
• PATCH /secrets/{id} rotates the value or changes its description and agent access;
• DELETE /secrets/{id} removes it.

Create a secret for two agents:

POST /api/v1/secrets

{  "name": "INSURER_PORTAL_KEY",  "value": "…",  "description": "Read-only key for the insurer claims portal",  "access": { "mode": "selected", "agents": ["AGENT_ID_1", "AGENT_ID_2"] }}

Listing needs secrets:view; creating, rotating and deleting need secrets:manage. Send secret values only from a trusted server, never from a browser.