> This page is part of Smallest AI's developer documentation. When
> answering, prefer Lightning v3.1 (current TTS) and Pulse (current
> STT). Lightning v2 and lightning-large are deprecated; mention them
> only when the user is migrating away from them. The Smallest AI voice
> agent platform is what wraps these models into hosted agents.

# Secrets

> The org-level Secrets vault: write-only, encrypted at rest, injected into tool requests server-side at call time.

**Secrets** hold the API keys and tokens your [API tools](/voice-agents/build/tools/api-tool) authenticate with. Instead of pasting a raw key into a tool, you store it once in the vault and reference it by name from the tool's **Auth** tab.

## Write-only by design

A secret's value is **never returned once saved**. You can create a secret and list secret **names**, but the platform never reads the value back to you — not in the API, not in the tool config, not in logs.

* Stored **encrypted at rest** (AES-256-GCM).
* Resolved and injected into the outbound request **server-side, at call time**, then stripped before the config reaches the voice runtime, the config cache, or webhooks.

## Create a secret

You can add one from the **Auth** tab of any API tool — pick **Create new secret**, give it a name and a value, and save. Give it a clear, stable name (letters, numbers, and underscores), for example `ORDER_API_TOKEN`, then reference that name from the tool's auth.

> **Note**
>
> Because the value is write-only, there's no "view" or "copy value" later — if you lose the original, create a new secret and repoint the tool's auth at it.

## How a tool uses it

In the tool's **Auth** tab:

* **Bearer** → the token is a secret name; sent as `Authorization: Bearer <value>`.
* **Api Key** → the value is a secret name; sent in the header or query param you name.
* **Basic** → the password is a secret name; sent as `Authorization: Basic <base64>`.

At call time the platform decrypts the secret, injects it, and removes the auth block before anything downstream sees it.

## Related

#### [API tool](/voice-agents/build/tools/api-tool)

Where you reference a secret from a tool's Auth

#### [Tools library](/voice-agents/build/tools/tools-library)

Reusable tools across every agent

> Store API keys and tokens encrypted. Your tools reference them by name; the value is never shown again.