Workspace Secrets

Secrets are the write-only workspace vault for passwords, tokens, and other credentials used by webhook Tools or channels. Owners and admins can add and delete them. Members cannot manage the vault; API keys may only list names when the called operation permits it.

Store a write-only value#

Open Settings → Secrets, choose Add secret, and enter a stable name using letters, numbers, dashes, or underscores. The value remains visible while you type so you can check a pasted token. After save, no dashboard or API response can show it again. Lists return only the Secret ID, name, and creation time.

Values are encrypted at rest with authenticated encryption and tied to both workspace and name. The runtime can decrypt a value only when executing the resource that refers to it. Do not put credentials in agent prompts, Tool descriptions, Workflow text, or conversation notes.

A duplicate Secret name is rejected. There is no in-place value update and no read-back endpoint.

Check dependencies before delete#

Resources refer to a Secret by name. A webhook Tool validates that the named Secret exists before sending HTTP; if the value is missing, it returns a safe validation failure instead of making an unauthenticated request. A Telegram channel also needs its saved Secret. The post-call webhook's generated signing Secret has a database dependency and is managed as part of that configuration.

The Secrets screen does not present a complete dependency graph. Before Delete, search Tools and channels for the name, pause affected production use, and retain the replacement value in an approved external secret manager. Deleting a value is irreversible from Operade.

Replace a credential safely#

Replacement is not atomic. For a webhook Tool, detach every dependent Tool from the old Secret, delete the Secret, recreate it with the same name and new value, then reattach and test each Tool. The detach, delete, recreate, and reattach steps create an interruption window; calls during that window can fail.

For a Telegram channel, pause and delete the channel before replacing its token Secret, then recreate the one-bot–one-agent mapping. Do not attempt this sequence for the generated post-call signing Secret: that configuration has no customer reset, delete, or rotation operation.

Test a harmless request after replacement and inspect the tool_call record under Activity. If the remote system returns HTTP 401 or 403, verify the selected Secret name, current external credential, and authentication mode. Continue with Tool authentication for Bearer, Basic, and custom-header behavior.