SECRETS · 4 CONFIGURED · 0 MISSING
Environment variables
Each secret has a policy. Creator vault = you provide the key, all users share it (and your cost). User vault = each user provides their own (zero cost to you, more friction for them). Values are encrypted at rest with AES-256-GCM.
Policy rule · PR #53. If a secret has user-vault, the /p/:slug run surface shows a "Connect your API key" step on first run. If creator-vault, your users don't see anything — they just run.
Docs →
SECRET NAME
POLICY
LAST USED
OPENAI_API_KEY
sk-pro****************************************8b2a
12s ago
AMADEUS_API_KEY
amd_*****************************e82f
2m ago
STRIPE_SECRET_KEY
Per-user. Each user supplies their own on first run.
218 users · last 7d
SUPABASE_SERVICE_KEY
eyJ******************************yIJ9
4m ago
ADD A SECRET
New env var
PASTE .ENV · BULK IMPORT
lines starting with # ignored · values encrypted before leaving your browser
AES-256-GCM at rest. Keys are scoped per-app and never exposed in logs, error messages, or client responses. Rotation triggers a 5-minute grace period where both old and new values work.
Read security →