# Organization secrets

Secrets hold the values a cloud run needs, such as `OPENROUTER_API_KEY` and any environment variable a Workbench declares. Manage them on your organization's secrets page in the dashboard.

## Who can manage them

Only owners and admins, signed in to the dashboard. Members cannot manage secrets, and API keys are refused with 403, so no integration can read or write them.

## Write only

Secrets are write only. You can list names and timestamps, set a value, replace it, and delete a secret. No page or API ever returns a value.

- Names are upper snake case, matching `^[A-Z][A-Z0-9_]*$`, at most 128 characters.
- Values are at most 32,768 bytes of UTF-8.
- Setting a name that exists replaces its value.
- Each set and delete is recorded in the audit log by name, never by value.

## How a run gets them

A cloud run receives, in its sandbox environment, the organization's `OPENROUTER_API_KEY` and a secret for every `env` name its Workbench declares. Every `env` entry the manifest marks required must have a secret of the same name, or the run fails before a sandbox exists with the reason. Check what a Workbench needs with the `view` MCP tool, whose `required_env` lists the required names.

The runner in the sandbox can read the values it receives. Before any run event or outcome file is stored, every injected value is replaced with `[redacted]`. Values shorter than eight characters are not matched, and a runner that encodes, splits, or reformats a value defeats exact matching.

A run on a [worker](/docs/workers/setup) gets the same secrets its Workbench declares. A worker run started with a `connection` other than `openrouter` is never sent the organization's OpenRouter key.

Standalone local CLI runs use your local configuration. They do not automatically receive secrets saved in the dashboard.

### Example: a Workbench that calls Stripe

1. Ask your agent to declare `STRIPE_API_KEY` in the Workbench's `env` configuration, marking it required if the task cannot run without it.
2. In the dashboard's **Run secrets** section, add the exact name `STRIPE_API_KEY` and paste the value.
3. Start a hosted or worker run. The tools in its runtime can read `STRIPE_API_KEY` from the environment.

Saving a secret does not make it available to every Workbench: names must match the Workbench's declared environment. Optional entries are supplied when a value is saved; required entries must have one before execution.

Replacing or deleting a secret affects future starts, not an environment that is already running.

## OpenRouter

Model tokens for cloud runs are always your own, on your OpenRouter key. Connect it from the secrets page in either of two ways:

- **Sign in with OpenRouter.** You approve on OpenRouter and the key it creates, labelled `<organization name> - Workbenches`, is saved as the `OPENROUTER_API_KEY` secret. The sign-in expires after 10 minutes.
- **Paste a key.** It is saved as the same secret.

Either way the key never leaves the server again. The page shows when it was saved and by whom, its label, and its remaining OpenRouter credits when OpenRouter reports them. Any member can see that status; only owners and admins can connect or replace the key.

## Encryption

Secrets use envelope encryption on Google Cloud KMS. Each organization has one random 32 byte data key, stored only wrapped by KMS and bound to the organization. Each secret is AES-256-GCM under that key with a fresh nonce and associated data of the organization and secret name, so a ciphertext copied to another name or organization fails to open.

## API

The secret routes are session only. They are listed on [Secrets](/docs/api/secrets) for completeness.