Secrets: API keys for your Genie Agents and Tools

A secret is an API key or token that a step needs to call another service — a Resend key for sending email, say, or a registry API’s token. Instead of pasting it into a flow, you save it once under a name, and a step refers to that name. The value itself is never shown again, not to you, not to your teammates, and not to Genie AI. Open Workspace settings → Secrets to manage them.

​

Choose who can use a secret

Every secret belongs to exactly one scope: If the same name exists at more than one scope, the most specific one wins: an agent’s or tool’s own secret is used first, then the workspace’s. That way a workspace-wide RESEND_API_KEY serves everyone, and one agent that needs a different account can hold its own without anything being renamed. A secret’s name is as private as what it belongs to — the names of a private agent’s secrets are only visible to people who can see that agent.

​

Add, replace, or delete a secret

1. Click Add secret.
2. Pick who can use it, then enter a Name (uppercase letters, digits, and underscores, starting with a letter) and paste the Value.
3. Click Save.

The page lists names only. To change a value, click Replace and paste the new one — a value can be replaced but never read back. Deleting a secret makes every step that uses it fail until you save it again (or until a workspace secret of the same name takes over), so Genie asks you to confirm first. If a step refers to a name that doesn’t exist anywhere, it stops with an error naming the secret — it never sends a request without its credentials.

​

Ask Genie AI to set one up

Genie AI can list your secrets’ names and walk you through what’s missing. When it needs a value, it shows a card in the chat where you type the key — the value goes straight to Genie’s servers and never passes through the AI or appears in the conversation. It can also delete a secret or change whether one is shared, each after you confirm on a card. Use Ask Genie AI on the Secrets page to start with a prompt about which keys your agents and tools are missing.

​

Share a secret with your Genie apps

A workspace secret can also be shared with your Genie apps. Genie then copies it into each app’s Genie Cloud, where the app’s own Edge Functions can read it. Turn sharing on with the Apps button on a secret’s row. Sharing is careful about who else could see the value:

• A Genie Cloud that also serves an app outside this workspace is skipped, and the page tells you how many apps that affects.
• If an app sets its own value under the same name, the app’s value wins and is left alone.
• Genie’s built-in names are managed per app and can’t be shared.

Saving a shared secret pushes the new value, so rotating it reaches every app that still holds the old one. Turning sharing off, or deleting the secret, removes it again. The row shows how many apps were reached and why any were skipped; sharing a secret again also brings it to apps created since. Each app’s own secrets are still managed in that app’s settings — see Project secrets. Saving, deleting, and sharing changes are recorded by name in the activity log — never the value.

​

Related pages