> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fonoster.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> What workspace secrets are, what uses them today, and how to manage them.

A **secret** is a named, encrypted value stored in your workspace. Today, Fonoster uses secrets for
one thing: your [vendor keys](https://docs.fonoster.com/workspace/provider-keys.md). When you set your own Deepgram,
ElevenLabs, OpenAI or Groq key, Fonoster stores it as a secret and uses it on your workspace's
calls.

> [!NOTE]
>
> Agents and streams don't read secrets by name yet. An Autopilot tool's headers are stored as
> plain text in the agent, and Fonoster doesn't fill them from secrets. See
> [Keys in headers](https://docs.fonoster.com/autopilot/tools.md#keys-in-headers). A stream runs on your own server, so keep
> its credentials in your server's environment.

## Vendor keys are secrets

Each vendor key you set appears under **Secrets** with the name `provider-key/<provider>`, such as
`provider-key/deepgram`. Manage these from [Vendor keys](https://docs.fonoster.com/workspace/provider-keys.md), not from
**Secrets**:

* To change a key, set it again under **Vendor keys** or with `fonoster providers:keys:set`.
* Deleting a `provider-key/…` secret removes that vendor key. Calls go back to the platform's key.

## Manage secrets

Anyone who can sign in to the workspace, members included, can create, change and delete its
secrets.

A secret's name has 3 to 32 characters: letters, numbers, underscores and hyphens, such as
`DEEPGRAM_API_KEY`. The value can be any text.

**Dashboard**

1. Go to **Secrets**.
2. Choose **Add secret**.
3. Enter the **Name** and the **Value**.
4. Choose **Save**.

To change one, open it, enter a **New value** and choose **Save**. Leave the value empty to
keep the current one. To delete it, choose **Delete** and confirm.

**SDK**

Create a secret, list the workspace's secrets, then delete one by its ref:

```javascript theme={"system"}
const secrets = new SDK.Secrets(client);

const { ref } = await secrets.createSecret({
  name: "ACME_PAYMENTS_TOKEN",
  secret: process.env.ACME_PAYMENTS_TOKEN
});

const { items } = await secrets.listSecrets({ pageSize: 50 });

await secrets.deleteSecret(ref);
```

See [Workspaces, members and API keys](https://docs.fonoster.com/workspace/access.md#sign-in-from-the-sdk) to create
`client`.

**CLI**

Create a secret. The CLI asks for the name and the value:

```bash theme={"system"}
fonoster secrets:create
```

List, update and delete secrets by ref:

```bash theme={"system"}
fonoster secrets:list
fonoster secrets:update 8d4f2b6a-1c9e-4a3d-b7f0-5e2c8a1d9b46
fonoster secrets:delete 8d4f2b6a-1c9e-4a3d-b7f0-5e2c8a1d9b46
```

For every command and method, see [Secrets in the CLI reference](https://docs.fonoster.com/reference/cli.md#secrets) and
[Secrets in the Node SDK reference](https://docs.fonoster.com/reference/sdk.md#secrets).

## Next steps

> **[Use your own vendor keys](https://docs.fonoster.com/workspace/provider-keys.md)**
>
> Set the vendor keys your calls use.

> **[Give your agent tools](https://docs.fonoster.com/autopilot/tools.md)**
>
> Call your API from an agent, and how to protect the key in its headers.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.