Secrets
Store API keys and tokens encrypted. Your tools reference them by name; the value is never shown again.
Secrets hold the API keys and tokens your API tools authenticate with. Instead of pasting a raw key into a tool, you store it once in the vault and reference it by name from the tool’s Auth tab.
Write-only by design
A secret’s value is never returned once saved. You can create a secret and list secret names, but the platform never reads the value back to you — not in the API, not in the tool config, not in logs.
- Stored encrypted at rest (AES-256-GCM).
- Resolved and injected into the outbound request server-side, at call time, then stripped before the config reaches the voice runtime, the config cache, or webhooks.
Create a secret
You can add one from the Auth tab of any API tool — pick Create new secret, give it a name and a value, and save. Give it a clear, stable name (letters, numbers, and underscores), for example ORDER_API_TOKEN, then reference that name from the tool’s auth.
Because the value is write-only, there’s no “view” or “copy value” later — if you lose the original, create a new secret and repoint the tool’s auth at it.
How a tool uses it
In the tool’s Auth tab:
- Bearer → the token is a secret name; sent as
Authorization: Bearer <value>. - Api Key → the value is a secret name; sent in the header or query param you name.
- Basic → the password is a secret name; sent as
Authorization: Basic <base64>.
At call time the platform decrypts the secret, injects it, and removes the auth block before anything downstream sees it.