{"schemaVersion":"1","contentVersion":"2026-10-18.1","slug":"secrets","title":"Secrets and integrations","summary":"Connect external services while keeping credentials out of prompts and frontend code.","category":"Go deeper","minutes":8,"prerequisites":["An existing service credential with the scope your integration needs.","Permission to manage secrets in the target project."],"sections":[{"id":"secret","title":"What belongs in a secret?","blocks":[{"type":"paragraph","text":"Store API keys, service passwords, and signing values as protected secrets. Keep them out of public source files, browser bundles, screenshots, and chat prompts. Use clear names so your team can identify each secret without reading its value."},{"type":"paragraph","text":"Open [Secrets](/guides/controls-secrets#browse) to review each secret’s name, type, and description. Existing values stay hidden. When editing, leave the value empty to keep it unchanged."}]},{"id":"add","title":"Add and use a secret","blocks":[{"type":"steps","items":["Open [Secrets](/guides/controls-secrets#browse) in [System Explorer](/guides/controls-preview#navigation) and confirm the intended project.","Use the add control, then enter a descriptive name, choose the appropriate type, and briefly explain the secret’s purpose.","Enter the value only in the secret value field and save it.","Configure the backend workflow or activity to reference the secret through its supported secret selector or configuration.","Run a harmless integration check and inspect a redacted result."]},{"type":"note","title":"Do not paste a key into a URL","text":"Query strings can appear in logs and browser history. Use the integration’s supported secret-backed authentication settings instead."}]},{"id":"access","title":"Grant only the access needed","blocks":[{"type":"paragraph","text":"Use [Manage access](/guides/controls-access#manage-access) for the secret to review who or what can use it. An integration needing one key should not automatically receive every project secret. Check inherited account-wide permissions as well as local groups."}]},{"id":"rotation","title":"Replace a credential deliberately","blocks":[{"type":"steps","items":["Identify every workflow or activity that uses the credential.","Create a replacement at the service provider using its normal process.","Edit the Rumata secret and enter the replacement value.","Verify an authorized test request works.","Revoke the old provider credential after dependent integrations have switched successfully."]},{"type":"paragraph","text":"Deleting the secret before updating the integrations that use it can break those integrations. If a key was exposed, treat revocation and replacement as an incident response rather than simply hiding the value in the UI."}]}],"technical":[],"related":["controls-secrets","system-explorer-workflows","collaboration","system-explorer-activities","troubleshooting"],"sources":["kondor_frontend/rumata_studio/src/components/window/explorer/SecretsView.tsx","kondor_frontend/rumata_studio/src/components/window/explorer/FactoryJwtSecretCard.tsx","kondor_frontend/rumata_studio/src/components/window/explorer/graph-workflows/node-config/HttpSection.tsx"],"updated":"2026-09-06","audience":"general","media":[{"src":"https://docs.rumata.dev/media/manual/secrets.jpg","width":1662,"height":789,"alt":"Project Secrets showing a protected factory JWT secret and its workflow reference.","caption":"Reference capture from the separate Sabai Talk Thai application (September 8, 2026). The system-managed value stays hidden. [Workflows](/guides/controls-workflows#list) refer to the secret by its reference rather than placing its value in documentation.","sectionId":"secret"},{"src":"https://docs.rumata.dev/media/manual/new-secret.jpg","width":1662,"height":789,"alt":"Empty Add Secret form in Rumata.","caption":"Reference capture from the separate Sabai Talk Thai application (September 8, 2026). Add Secret opens a form. Review the name and value before saving; this empty form was cancelled.","sectionId":"add"}],"video":null,"url":"https://docs.rumata.dev/guides/secrets"}