Manage secrets

Manage the API keys and credentials your agents and connectors need. Secrets are held in secure (Conjur-backed) storage at the organization level and referenced by name — once saved, the value is never readable from the UI again.

Before you start

• You’re an organization owner or admin — secrets are managed at Settings → Secrets.
• For an add, you have the value ready to paste. It’s stored encrypted and can’t be read back.

Where secrets live

At Settings → Secrets (organization) there are two areas:

• AI Providers — the keys for OpenAI, Anthropic, and Google, in dedicated slots. Agents use these to call models.
• Custom secrets — named slots for everything else (a connector token, an OAuth client secret). Connectors and MCP servers reference them by name.

Secrets can be scoped by tier — project, organization (the default), or environment — and reserved name prefixes (ai_, integration_, instance_, mcp_) mark what a secret is for.

Add a secret

1. Open Settings → Secrets.

   Screenshot placeholderSettings → Secrets — AI Providers and custom secretsReplace with real capture from app.superagent.studio

2. Add it. For a model key, use the AI Providers tab — pick the provider and paste the key. For anything else, add a custom secret with a name and its value.

3. Save. The value is encrypted; the list shows the name, never the value.

4. Reference it. In a connector’s setup or an agent’s configuration, the credential field lists secrets by name — pick this one. The runtime resolves the name to the value at call time.

Rotate a secret

1. Generate the new value at the provider. Keep the old one active for the cutover window.

2. Update it. Open the secret at Settings → Secrets and set its new value.

3. Save. Every resource that references the secret picks up the new value on its next call — no redeploy needed.

4. Verify, then revoke. Trigger one run that uses the secret and watch it succeed in Workflow Executions, then retire the old value at the provider.

Troubleshooting

• Rotate succeeded but runs still fail with 401/403. The provider takes a moment to propagate; wait and retry, and check the pasted value didn’t pick up trailing whitespace.
• Permission denied. Adding or rotating secrets requires the organization owner or admin role.

Never paste secrets into prompts or process variables

An agent’s system prompt and a process’s variables are visible to members and recorded in the audit trail. Always reference secrets by name; the runtime resolves the name to the value at the point of use, never leaking it to logs or the UI.

Related

Managing secrets (user guide)Secrets as a narrative tour, with the principles behind them.

Build an integrationWhere connector credentials are used.

Give an agent toolsAgents resolve model keys and tool credentials by name.