> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace secrets

> Store a private workspace value, use its identifier in supported configuration, and review dependencies before replacement or removal.

Workspace secrets hold private values that supported configuration fields can reference by identifier. A secret is not a prompt variable, an API key for Threetone, or a complete provider connection.

<Frame caption="Recording pending: Add and review a workspace secret without showing its value. Follow the written guide below.">
  <img src="https://mintcdn.com/threetonelabs-c2efc9c8/RV32i5440UZIaFHA/images/tutorials/recording-pending.webp?fit=max&auto=format&n=RV32i5440UZIaFHA&q=85&s=55f66d2eef49d8c92c9ac46f84bace35" alt="Recording pending for workspace secret configuration. No playable video is available yet." width="1600" height="900" className="w-full h-auto aspect-video" loading="lazy" noZoom data-path="images/tutorials/recording-pending.webp" />
</Frame>

## Add a secret

<Steps>
  <Step title="Open workspace credential settings">
    Select the intended workspace and open [Agent Settings](https://threetone.in/app/agents/settings). Find **Workspace secrets** and select **Add secret**.
  </Step>

  <Step title="Enter a useful name and private value">
    Enter **Name** and **Value**, then submit the form. Use a name that identifies the purpose without including the credential itself. Do not include customer data in the name.
  </Step>

  <Step title="Confirm the stored reference">
    Reopen the list, confirm the saved name and identifier, and inspect any recorded dependencies. The raw value is not retrievable through this settings workflow. Keep the original credential in your approved private credential storage.
  </Step>
</Steps>

<Frame caption="Screenshot pending: Workspace secrets showing synthetic names, identifiers, and dependency counts, with no raw values.">
  <img src="https://mintcdn.com/threetonelabs-c2efc9c8/-FnvNeuT_PFanG1t/images/placeholders/screenshot-pending.svg?fit=max&auto=format&n=-FnvNeuT_PFanG1t&q=85&s=b29809bcbd6979cc43ace35853669b46" alt="Screenshot pending for the workspace secret list. This illustration is not a product screenshot." width="1600" height="1000" className="w-full h-auto" loading="lazy" noZoom data-path="images/placeholders/screenshot-pending.svg" />
</Frame>

## Use a supported reference

Use the saved identifier where a field explicitly accepts a secret reference. For example, a secret-typed [environment value](/agents-platform/deploy/environment-variables) uses a `secret_id` reference. Plain strings and prompt placeholders do not become private simply because you put a secret value inside them.

Use [auth connections](/agents-platform/configure/authentication/auth-connections) when the provider needs a structured authentication method. Use a native integration's own workflow for its managed credentials. These resources have different ownership and update behavior.

## Replace or remove safely

Review dependent resources before changing a credential. For replacement, prepare the new secret, update the intended references through their supported workflow, and verify the resulting configuration before retiring the old provider credential. Revoking a provider credential and deleting a Threetone secret are different actions.

If deletion reports dependencies, inspect those resources instead of assuming the reference is unused. Do not promise immediate provider revocation, historic-data erasure, or automatic cleanup of all agent versions from a secret-deletion response.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can I retrieve the stored secret value from Settings?" id="faq-secret-readback">No. Verify its name, identifier, and dependencies through the supported workflow. Store the original credential privately when the provider issues it.</Accordion>
  <Accordion title="Can I put the value in a dynamic variable instead?" id="faq-secret-prompt-variable">Do not use prompt placeholders for private credentials. A supported secret reference identifies private storage; a string in a prompt does not.</Accordion>
  <Accordion title="Does deleting the secret revoke the provider key?" id="faq-secret-provider-revocation">Provider revocation is a separate action. Follow that provider's credential-management workflow and verify dependent resources before removal.</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.