Recording pending: Add and review a workspace secret without showing its value. Follow the written guide below.
Add a secret
1
Open workspace credential settings
Select the intended workspace and open Agent Settings. Find Workspace secrets and select Add secret.
2
Enter a useful name and private value
Enter Name and Value, then submit the form. Use a name that identifies the purpose without including the credential itself. Do not include customer data in the name.
3
Confirm the stored reference
Reopen the list, confirm the saved name and identifier, and inspect any recorded dependencies. The raw value is not retrievable through this settings workflow. Keep the original credential in your approved private credential storage.
Screenshot pending: Workspace secrets showing synthetic names, identifiers, and dependency counts, with no raw values.
Use a supported reference
Use the saved identifier where a field explicitly accepts a secret reference. For example, a secret-typed environment value uses asecret_id reference. Plain strings and prompt placeholders do not become private simply because you put a secret value inside them.
Use auth connections when the provider needs a structured authentication method. Use a native integration’s own workflow for its managed credentials. These resources have different ownership and update behavior.
Replace or remove safely
Review dependent resources before changing a credential. For replacement, prepare the new secret, update the intended references through their supported workflow, and verify the resulting configuration before retiring the old provider credential. Revoking a provider credential and deleting a Threetone secret are different actions. If deletion reports dependencies, inspect those resources instead of assuming the reference is unused. Do not promise immediate provider revocation, historic-data erasure, or automatic cleanup of all agent versions from a secret-deletion response.Frequently asked questions
Can I retrieve the stored secret value from Settings?
Can I retrieve the stored secret value from Settings?
No. Verify its name, identifier, and dependencies through the supported workflow. Store the original credential privately when the provider issues it.
Can I put the value in a dynamic variable instead?
Can I put the value in a dynamic variable instead?
Do not use prompt placeholders for private credentials. A supported secret reference identifies private storage; a string in a prompt does not.
Does deleting the secret revoke the provider key?
Does deleting the secret revoke the provider key?
Provider revocation is a separate action. Follow that provider’s credential-management workflow and verify dependent resources before removal.