> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genie-app.de/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets: API keys for your Genie Agents and Tools

> Store an API key or token once in your workspace and let Genie Agents, Genie Tools, and optionally your Genie apps use it — without the value ever being shown again.

A **secret** is an API key or token that a step needs to call another service — a Resend key for sending email, say, or a registry API's token. Instead of pasting it into a flow, you save it once under a name, and a step refers to that name. The value itself is never shown again, not to you, not to your teammates, and not to Genie AI.

Open **Workspace settings → Secrets** to manage them.

> [!NOTE]
>
> You need permission to view integrations, Genie Agents, or Genie Tools to see the page. What you can change depends on the secret's scope, below.

## Choose who can use a secret

Every secret belongs to exactly one scope:

| Scope | Who can use it | Who can add or change it |
| - | - | - |
| **Whole workspace** | Every Genie Agent and Genie Tool in the workspace — and, if you share it, your Genie apps | Members who can manage integrations |
| **One Genie Agent** | Only that agent | Members who can edit that agent |
| **One Genie Tool** | Only that tool | Members who can edit that tool |

If the same name exists at more than one scope, the most specific one wins: an agent's or tool's own secret is used first, then the workspace's. That way a workspace-wide `RESEND_API_KEY` serves everyone, and one agent that needs a different account can hold its own without anything being renamed.

A secret's name is as private as what it belongs to — the names of a private agent's secrets are only visible to people who can see that agent.

## Add, replace, or delete a secret

1. Click **Add secret**.
2. Pick who can use it, then enter a **Name** (uppercase letters, digits, and underscores, starting with a letter) and paste the **Value**.
3. Click **Save**.

The page lists names only. To change a value, click **Replace** and paste the new one — a value can be replaced but never read back. Deleting a secret makes every step that uses it fail until you save it again (or until a workspace secret of the same name takes over), so Genie asks you to confirm first.

If a step refers to a name that doesn't exist anywhere, it stops with an error naming the secret — it never sends a request without its credentials.

## Ask Genie AI to set one up

Genie AI can list your secrets' names and walk you through what's missing. When it needs a value, it shows a card in the chat where **you** type the key — the value goes straight to Genie's servers and never passes through the AI or appears in the conversation. It can also delete a secret or change whether one is shared, each after you confirm on a card.

Use **Ask Genie AI** on the Secrets page to start with a prompt about which keys your agents and tools are missing.

## Share a secret with your Genie apps

A workspace secret can also be **shared with your Genie apps**. Genie then copies it into each app's Genie Cloud, where the app's own Edge Functions can read it. Turn sharing on with the **Apps** button on a secret's row.

> [!WARNING]
>
> Anything running on an app's Genie Cloud can read a shared secret. Share only what your apps' code should have.

Sharing is careful about who else could see the value:

* A Genie Cloud that also serves an app **outside this workspace** is skipped, and the page tells you how many apps that affects.
* If an app sets its **own** value under the same name, the app's value wins and is left alone.
* Genie's built-in names are managed per app and can't be shared.

Saving a shared secret pushes the new value, so rotating it reaches every app that still holds the old one. Turning sharing off, or deleting the secret, removes it again. The row shows how many apps were reached and why any were skipped; sharing a secret again also brings it to apps created since. Each app's own secrets are still managed in that app's settings — see [Project secrets](https://docs.genie-app.de/projects/secrets.md).

Saving, deleting, and sharing changes are recorded by name in the [activity log](https://docs.genie-app.de/workspaces/overview.md#activity-log) — never the value.

## Related pages

> [card] [Genie Agents](https://docs.genie-app.de/workspaces/workflow-apps.md)
>
> Steps that call an API use a secret by name.

> [card] [Project secrets](https://docs.genie-app.de/projects/secrets.md)
>
> The secrets a single app's Edge Functions read.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.