# Secret controls

Add or update secrets, manage access, and find the references your workflows use.

Source: https://docs.rumata.dev/guides/controls-secrets
Reviewed: 2026-09-06

## Before you start

- Open the named screen in Rumata. Available controls may depend on your account, permissions, and resource state.

<a id="browse"></a>

## Find a secret

Open [System Explorer](https://docs.rumata.dev/guides/controls-preview#navigation) → [Secrets](https://docs.rumata.dev/guides/controls-secrets#browse). Secret values are write-only: after saving, the screen shows a protected placeholder rather than the original value.

| Control | What it does |
| --- | --- |
| Search secrets | Filter by name or description. It cannot search the protected values. |
| Add Secret | Open a new-secret form. A project must be selected. |
| Edit pencil | Open an existing secret’s metadata and an empty field for an optional replacement value. |
| Manage access | Open group-level permissions for this secret. |
| Protected value display | Indicate that a value has been stored. It is not a reveal or copy-value control. |

![Project Secrets showing a protected factory JWT secret and its workflow reference.](https://docs.rumata.dev/media/manual/secrets.jpg)

Reference capture from the separate Sabai Talk Thai application (September 8, 2026). The system-managed value stays hidden. [Workflows](https://docs.rumata.dev/guides/controls-workflows#list) refer to the secret by its reference rather than placing its value in documentation.

<a id="create-edit"></a>

## Add or edit a secret

Use a recognizable name such as PAYMENT_API_KEY and a description that explains its purpose without including the credential itself.

| Control | What it does |
| --- | --- |
| Name | Set the identifier when creating the secret. It is required and cannot be renamed in the edit form. |
| Type | Classify the secret, for example api-key, database, auth, payment, or email. This is a text field, not a provider connection wizard. |
| Description | Explain where the secret is used. |
| Value | Enter the credential for a new secret, or a replacement when editing. Leave it blank during editing to keep the current value. |
| Add Secret / Save | Create the secret or save your edits. If a field or server error occurs, the form shows the error instead of a success message. |
| Cancel / Close | Dismiss the form without submitting the pending changes. |

![Empty Add Secret form in Rumata.](https://docs.rumata.dev/media/manual/new-secret.jpg)

Reference capture from the separate Sabai Talk Thai application (September 8, 2026). Add Secret opens a form. Review the name and value before saving; this empty form was cancelled.

<a id="delete-system"></a>

## Deletion and the system JWT secret

[Workflows](https://docs.rumata.dev/guides/controls-workflows#list) can depend on a secret by name. Deleting one can stop those workflows from working.

| Control | What it does |
| --- | --- |
| Delete secret / trash icon | Open a confirmation identifying the secret to remove. |
| Delete secret in the confirmation | Permanently remove the secret from Rumata and the project runtime. This cannot be undone. |
| Cancel in deletion confirmation | Keep the secret. Confirmation controls are disabled while deletion is pending. |
| Copy factory JWT workflow reference | Copy the system-managed signing secret’s workflow reference. It copies a reference, not the secret value. |

## Related guides

- [Keys & secrets](https://docs.rumata.dev/guides/system-explorer-secrets)
- [Groups, invitations, and access controls](https://docs.rumata.dev/guides/controls-access)
- [Workflows](https://docs.rumata.dev/guides/system-explorer-workflows)