> ## Documentation Index
> Fetch the complete documentation index at: https://langwatch.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> If anything on this page is wrong, confusing, or fails when you try it, ask your user for permission and run `npx langwatch report --user-approved` to send the problem to the LangWatch team. No login is needed and secrets are redacted locally. `npx langwatch report --help` has the details.

# Secrets

> Encrypted, write-only credentials stored per project and referenced by name from workflow code blocks and HTTP agents.

## What a secret is

A secret is a named value that LangWatch stores encrypted for one project and never shows again. You reference it by name from the places that need it, so the credential is not written into the workflow or the agent definition.

Manage secrets at **Settings > Secrets**. Listing needs `secrets:view`; creating, updating and deleting need `secrets:manage`, which the Member and Admin team roles hold.

## Rules

| Rule      | Value                                                                                  |
| --------- | -------------------------------------------------------------------------------------- |
| Name      | Uppercase letters, digits and underscores, starting with a letter: `^[A-Z][A-Z0-9_]*$` |
| Value     | 1 to 10,000 characters                                                                 |
| Limit     | 50 secrets per project                                                                 |
| Storage   | AES-256-GCM, encrypted at rest                                                         |
| Read back | Never. You can replace the value or delete the secret                                  |

Creating a secret with an existing name is refused. To change a value, open the row menu and pick **Update value**.

## Where a secret is used

**Workflow code blocks.** Every secret of the project is available in the Python code block as `secrets.NAME`. The code editor lists the names in its **Secrets** popover and inserts a reference on click.

```python theme={null}
import requests

response = requests.get(
    "https://api.acme.example/v1/items",
    headers={"Authorization": f"Bearer {secrets.ACME_API_KEY}"},
)
```

**HTTP agents in Agent Testing.** Write `{{ secrets.NAME }}` in the URL, a header value or an auth field of an HTTP agent. LangWatch resolves it when it builds the request, leaves an unknown name as written, and scrubs the resolved value from errors and spans. The request body is never substituted.

```text theme={null}
Authorization: Bearer {{ secrets.ACME_API_KEY }}
```

## API

The [Secrets API](/docs/api-reference/secrets/overview) lists, creates, updates and deletes secrets with a project API key. The list response never includes values.