Add secrets and credentials
Store credentials at the right scope and understand how sessions use them.
Use Settings → Secrets for credentials that work needs. Keep values out of repository files, manifests, prompts, and chat messages.
Read the visual explanation
A stored secret has workspace or repository scope. Allowed hosts constrain the supported proxy path. They are not enforced when a sandbox receives the actual value.
Add a secret
- Choose workspace scope or select the repository that should receive the credential.
- Add a descriptive name, such as
SERVICE_API_TOKEN. - Enter the value in the secret form.
- Review the delivery options and allowed-host settings shown by the form.
- Add a description that explains the intended use, then save.
The list shows metadata about stored credentials. Do not expect it to display an existing value back to you. Use the provider's own credential management when you need to rotate or revoke the source credential.
Choose scope and delivery carefully
A workspace secret is shared project configuration. A repository secret is associated with that repository's work. Select the narrow scope that matches the task and confirm that the session includes the relevant repository.
Allowed hosts restrict supported proxied HTTPS requests. The form accepts hosts such as api.example.com and *.example.org; an empty list permits any HTTPS host for that proxy path.
Host restrictions are not enforced in sandboxes that receive the actual value. If you enable actual-value delivery, the credential can be used by processes in that environment. Do not treat the allowed-host list as a sandbox-wide network boundary.
Update or revoke
Save the new value through the settings controls when rotating a secret. Check the next use in the intended session. Do not assume a running process has replaced a value it already received; restart or recover the affected work when needed.
Removing a stored secret prevents future resolution through that configuration. If the original credential may have escaped, revoke it at its provider as well; deleting metadata cannot retract a copied token.
For failures, include the secret name and scope when asking an admin for help, never the value. See environment problems and external tools.