Secrets

Secrets are credentials your Coworkers use, such as API tokens and passwords. Each secret has a name, for example CRM_DATABASE_URL, and a value. Values are write-only: once saved they can be replaced but never viewed, by anyone.

Accounts you connect through a system such as GitHub are not secrets and do not appear in these lists. See Connecting your accounts.

Where a value comes from#

A secret can be stored at four levels. When a Coworker uses a secret by name, it gets the most specific value that exists: yours (when it is working for you), then its own, then its Team's, then the company's.

Level	Who can add, replace and delete it
Organization (company-wide)	Admins
Teams	Admins
A single Coworker	That Coworker's Supervisor (who must hold Manage Coworkers)
My secrets (yours)	Only you. When an administrator revokes a person's access, that person's secrets are permanently deleted.

A Coworker can use a secret only after it has been given access to that name. Its Supervisor grants access, and supervisors never see the values they grant.

The Secrets page#

Open Settings and select Manage on the Secrets card (shown while Coworkers is on). The page has these tabs:

• Organization for company-wide secrets.
• Teams for each Team's secrets. Choose the Team from the list.
• Coworkers, shown when you supervise a Coworker and the Coworkers switch on Settings, then Features is on, with a card for each Coworker you manage.
• My secrets for your own values.

To add a secret, select Add secret, fill in Name (letters, digits and underscores), an optional Description and the Value, and select Save secret. Adding a company-wide secret asks you to confirm first. In the list, Replace value sets a new value and Delete removes the secret after you confirm.

Last used, Used by and History#

Every list of secrets you manage has columns beside the name:

• Last used shows when a Coworker last used the value and how many times it has been used (for example "2 uses"). It reads Not used until a Coworker uses it.
• Used by lists the Coworkers that have been given access to the secret's name, or reads No Coworkers.

Select History on a row to see what has happened to the secret, newest first, each with who did it and when. Select Hide history to close it, and Show more for older entries. Entries read, for example, "Created", "Value replaced", "Description changed", "Access given to" followed by a Coworker, "Access removed from" a Coworker, "Value provided when" a Coworker "asked for it", or "Deleted". A secret that was deleted when its owner's access ended says so. History never shows a value.

Encryption keys (administrators)#

Administrators also see an Encryption keys card below the tabs. It shows whether the deployment's master key, WI_MASTER_KEY, unlocks every stored credential, including these secrets, AI provider keys, single sign-on settings and the outgoing email password. It shows the fingerprint of each configured master key and, while a master key rotation is in progress, whether the previous key is still needed. Select Refresh to read it again. Nobody else sees the card. For what each message means, see Rotate the master key.

A Coworker's secrets#

A Coworker's Supervisor manages its secrets on the Coworkers tab of the Secrets page, or in the Secrets section of the Coworker's details page. Both show the same two lists.

Secrets followed by the Coworker's name and can use lists the names the Coworker has access to. Each name shows where its value comes from. "No value is set" means no value exists for the Coworker at any level; add one at the company, Team or Coworker level. To grant a name, type or pick it and select Give access.

Secrets only followed by the Coworker's name and has lists values that belong to this Coworker alone. They are used in place of a company or Team value with the same name.

Removing a secret from a Coworker#

Select Remove next to a name. A dialog asks Remove followed by the secret's name and the Coworker's name, and explains what happens:

• When the Coworker's value is its own, removing the name also deletes that value. The dialog reads "This also deletes the value saved for" the Coworker "only" and that this can't be undone. Select Remove and delete value.
• When the value is shared, only the Coworker's access is removed. The dialog notes that the Team value or the company-wide value stays as it is. Select Remove access.

Shared values, and your own value with the same name, are never deleted by removing a name from a Coworker. To see which secrets a connector uses, see Connectors for a Coworker.

When a Coworker asks for a secret in chat#

A Coworker that needs a credential asks for it with a card in the conversation rather than in the text. The card reads the Coworker's name, "is asking for", and the secret's name, with the Coworker's reason.

1. Type the value in Value.
2. If you are offered a choice under Where to store it, pick the level. Otherwise the card says where it will be stored.
3. If you are its Supervisor, tick Give the Coworker access to this secret so it can use the value straight away.
4. Select Save.

If a value already exists, the card shows Current value and offers Keep using the current value or Replace value. Dismiss declines the request. Once you answer, the Coworker continues by itself.