Secrets

Admin Secrets is a different store from a project’s own Settings › Secrets page. A project’s vault serves only that project; the global vault edited here is merged into {{secret.…}} resolution for every project on the deployment.

Use the global vault for a value every project should be able to reference — a shared API key for an internal tool, a company-wide webhook target — instead of copying the same secret into each project’s own vault, where it would need to be kept in sync by hand.

Manage a global secret

1. Open Admin › Secrets

   The table lists every global secret by key; values are masked.

2. Create one

   Give it a key and a value. Reference it from any project as {{secret.<key>}}, the same placeholder syntax used for a project-scoped secret.

3. Edit or delete it

   A write here is platform-wide — it changes what every project resolves for that key.

Note

There is no “hide” control for a global secret. A masked value already hides the secret; a separate hide action exists on neither this page nor its server route.

Note

The Internal tab is read-only for every administrator, including super admins. It groups entries the platform wrote for itself rather than ones an operator authored — recognized by name (auth_token, project_llm_key, and bare 32-character hex reference names minted for configuration credential fields), not by a separate server flag. Those rows are shown rather than hidden so the vault’s contents are fully accounted for, but nothing here offers to edit a value with no way of knowing what it is for.