Skip to content

Secrets

Secrets store sensitive values — API keys, tokens, passwords — that your site needs to call external services. They are used by Methods and are never exposed to the browser.

Key principles

  • A secret belongs to one site (template). Two sites of the same project do not share secrets.
  • The value is encrypted at rest (AES-256-GCM) and only decrypted on the server, at the moment a Method runs.
  • Once saved, a value can never be displayed again — not in the Studio, not through the API. You can only replace it.
  • Secrets are only available in Methods, through {{secrets.NAME}}. They are not available in templates (.hbs), datasources or metas.

Managing secrets

In the site editor, open the Secrets panel from the left activity bar.

Action What happens
Add Enter a name and a value, then save.
Rename Changes the name only. Update the Methods that use the old name.
Replace the value Enter a new value. The previous one is overwritten.
Delete Removes the secret. Methods that still reference it will fail.

Naming rules

A secret name uses uppercase letters, digits and underscores, and starts with a letter:

OPENAI_API_KEY     ✅
STRIPE_SECRET_KEY  ✅
openai_key         ❌  lowercase
2FA_TOKEN          ❌  starts with a digit

Names are unique within a site.

Using a secret

Reference a secret in a Method's headers (recommended) or JSON body. Avoid the URL and query parameters: they are part of the URL, which may end up in logs.

Authorization: Bearer {{secrets.OPENAI_API_KEY}}

The Studio suggests the site's secrets as you type {{secrets. in the Method editor, and warns you when:

  • a Method references a secret that does not exist in the site;
  • a secret is placed in the URL — URLs may end up in logs, prefer a header.

Keep secrets out of the browser

A secret is resolved server-side only. Never copy a secret value into a template, a translation file or an asset: those files are public.