Secrets

Secrets are environment variables and credentials available to an agent at runtime. Use them when tools, entrypoints, functions, or integrations need private values that should not appear in prompts, playbooks, or committed files.

Add a secret

Add secrets from the agent sidebar when you want the cloud runtime to inject them into the agent's sandbox. After saving, values are hidden by default. The agent reads them through the normal environment-variable interface for its runtime, such as process.env.LINEAR_API_KEY.

What secrets are for

• API keys: Tokens for internal services or third-party APIs.
• Configuration: Private base URLs, tenant IDs, or account-specific settings.
• Entrypoint setup: Tokens or registry credentials needed while installing dependencies.
• Function runtime: Values custom functions need without hard-coding them.

When to add a secret

Add a secret when a value is private, environment-specific, or likely to rotate. Reference the secret by key from the tool, entrypoint, or function that needs it.

Best practices

• Use clear uppercase keys like LINEAR_API_KEY or CRM_BASE_URL.
• Keep keys unique; duplicate keys cannot be saved.
• Rotate secrets when people leave a team or credentials are exposed.
• Use the smallest-scoped credential that lets the agent complete its task.
• Avoid pasting secret values into instructions, playbooks, or memory.
• Remove secrets that are no longer used by any tool.