Secrets

Keep credentials out of your tool code.

Secrets belong to a server. Their values are encrypted when stored.

Add a secret

1. Open your server’s Secrets tab.
2. Add a key such as API_KEY and its value.
3. Save it.

Use the same key in your code:

const response = await sdk.http({
  url: "https://api.example.com/items",
  headers: { Authorization: `Bearer ${env.API_KEY}` },
});

if (!response.ok) {
  throw new Error(`API returned ${response.status}`);
}

return response.json();

Replace the URL with your API.

Update or delete

Use the edit or delete action beside the secret. Keep the key the same if your tool already uses it.

Never print secret values. Do not include them in returned data or client configs. Server access keys are configured separately in Security.