# Keys & secrets
Manage your API keys and sensitive credentials securely—all in one place.
Source: https://docs.rumata.dev/guides/system-explorer-secrets
Reviewed: 2026-11-01
## Call a workflow from your backend
Follow [Call workflows with API keys](https://docs.rumata.dev/guides/api-keys) to create a credential, grant its group access to the target workflow, configure a server-side caller, and verify both authorized and rejected requests. Creating a key or saving it as a secret does not automatically grant workflow access.
## About Keys & secrets
Rumata provides built-in **API key and secret management**, allowing you to organize, store, and manage the credentials your applications, workflows, and services need.
Instead of storing API keys in your code or sharing them through chat, you can keep them in Rumata's centralized credential manager and access them at the project or factory level.
**Your secrets stay hidden from AI.** Rumata's AI agent can work with the names and references of your stored credentials, but it cannot read their actual values. This allows you to build AI-powered applications and integrations without sharing sensitive credentials directly with the AI model.
## Before you start
Open your factory workspace and navigate to **System Explorer → Keys & secrets**.
You'll find two main tabs:
- **API keys:** Create and manage credentials used to access Rumata resources.
- **Secrets:** Securely store sensitive values, such as third-party API keys, tokens, and other credentials used by your applications and workflows.
Both are managed from your Rumata workspace, so you can organize credentials without maintaining them separately in code or chat conversations.
## 1. Understand API keys and Secrets
Although both help manage credentials, they serve different purposes.
API keys
API keys created in Rumata allow authorized applications, backend services, and workflows to access Rumata resources.
You can control their expiration, review their status, and manage their access through resource permissions.
Secrets
Secrets are encrypted, write-only values used to store sensitive information.
For example, you might store:
- A Stripe API key for a payment integration.
- A Slack authentication token for sending notifications.
- An API key for an external AI provider.
- Credentials for a third-party service your application uses.
These values can be referenced by authorized workflows and services without exposing the credentials to the AI agent.
**The important difference:** The AI agent can identify a secret by its name or reference, but it cannot retrieve the stored credential value.
## 2. Create an API key
You can create API keys to give authorized applications and services access to Rumata resources.
Create a new API key
1. Go to **System Explorer → Keys & secrets**.
2. Open the **API keys** tab.
3. Click **Create API key**.
4. Enter a descriptive **Name** that is unique within your project.
5. Choose an expiration period: **7 days, 30 days, 90 days, 365 days, Custom**, or **Never expires**.
6. Review the expiration date and group-access information.
7. Click **Create and save credential** to create the key.
Rumata automatically saves the new credential in **Secrets** and adds it to the default factory API-key group with its supported storage and published-workflow access.
Custom groups need appropriate grants on the target resource. A key does not publish a draft or authorize unrelated resources; keep its value server-side and check application-user ownership separately.
Manage existing API keys
Use **Search API keys** and the status filters to find and review credentials.
API keys may display the following statuses:
- **Active:** The key is valid and available for authorized requests.
- **Expiring soon:** The key is approaching its expiration date.
- **Expired:** The key can no longer authorize requests.
- **Revoked:** The key has been disabled and cannot be used.
You can also select **Add existing key** to attach a credential already available within the project.
> **Good to know**
> Key expiration is checked on each request. Expired and revoked keys remain visible for reference but cannot authorize new requests.
API-key management includes search, status filters, and creation controls. Illustrative interface reference; your resources and values may differ.
## 3. Store and manage secrets securely
The **Secrets** tab acts as your centralized credential manager.
Instead of placing sensitive values directly in source code, workflow configurations, or AI conversations, you can store them securely in Rumata.
Add a new secret
1. Open **System Explorer → Keys & secrets**.
2. Select the **Secrets** tab.
3. Click **Add Secret**.
4. Enter a descriptive **Name**, select the appropriate **Type**, and add a **Description**.
5. Enter the sensitive credential in the **Value** field.
6. Click **Add Secret** to save it.
Once saved, Rumata stores the value in encrypted, write-only storage.
> **Important**
> Secret values cannot be read back after saving. A masked value is not a reveal option.
Find secrets by project or factory
You can manage credentials centrally while identifying which secrets are associated with your current project or factory.
1. Open the **Secrets** tab.
2. Use **Search secrets** to find a credential by name.
3. Review the available secrets associated with your project.
4. Enable **Only this factory** to narrow the list to secrets associated with the current factory.
5. Select the relevant secret to review its available information and references.
This makes it easier to organize credentials across applications without repeatedly entering the same sensitive information.
> **Good to know**
> Some system-managed secrets, such as factory signing credentials, are protected by Rumata and cannot be deleted.
Add a secret using Name, Type, Description, and the write-only Value field. Illustrative interface reference; your resources and values may differ.
## 4. Use secrets with AI without exposing credentials
One of Rumata's key security features is the separation between your stored credentials and the AI agent.
You can ask Rumata to build integrations that require sensitive credentials without providing those credentials directly in your conversation.
How it works
1. Store your API key or credential in **Keys & secrets → Secrets**.
2. Give the secret a recognizable name, such as `STRIPE_API_KEY`.
3. In the AI Chat, describe the integration you want to build.
4. Refer to the stored secret by its name instead of pasting its value.
5. Rumata's AI agent can use the secret reference when configuring supported workflows or services, subject to their permissions.
6. The authorized execution environment uses the credential when the integration runs, without exposing its value to the AI model.
Example
Imagine you want your application to send Slack notifications.
First, store your Slack token in Rumata's Secrets manager under the name `SLACK_BOT_TOKEN`.
Then, ask the AI agent:
> **Example: Example prompt**
> Create a workflow that sends a Slack notification whenever a new customer registers. Use the existing secret named SLACK_BOT_TOKEN for authentication.
The agent can configure the workflow using the secret's reference without needing to know the actual token.
**Your AI agent works with the name. Your application uses the credential.**
> **Important**
> Keeping values hidden from AI does not remove the need for proper access controls. Only grant workflows and services access to the credentials they actually need.
## 5. Manage credential access and permissions
Rumata lets you manage which authorized resources can use your credentials.
This helps you control access at the project and factory level without exposing sensitive values.
Review access permissions
1. Open **Keys & secrets** and find the relevant credential.
2. Review its associated project, factory, or resource group information.
3. Check which groups have permission to access the credential.
4. Grant or adjust access only when needed for an intended workflow or service.
5. Test the integration to confirm it can access the required resource.
> **Good to know**
> A credential being stored in Rumata does not automatically mean every workflow or service can use it. Access depends on the relevant permissions and configuration.
## 6. Maintain and troubleshoot credentials
If an integration stops working, you can review its credentials without exposing their values.
Troubleshoot credential issues
1. Open **Keys & secrets**.
2. Find the relevant API key or secret.
3. For Rumata API keys, verify that the key is active and hasn't expired or been revoked.
4. Review the resource group's permissions and the integration's credential reference.
5. Check the corresponding workflow run or service logs for the reported error.
6. Correct the issue and test the integration again.
Keep credentials secure
Follow these practices when managing API keys and secrets:
- Store credentials in **Secrets**, not directly in AI Chat or source code.
- Use descriptive names so you can identify their purpose without exposing their values.
- Give workflows and services only the access they require.
- Review expiration dates for API keys.
- Replace credentials when they are compromised or no longer needed.
- Check dependent integrations before replacing or revoking an existing credential.
Check your result
Your credentials should be securely stored, visible through their names and available metadata, and accessible only to the authorized resources that need them.
## One place for all your credentials
With Rumata, you don't need to scatter API keys across code files, workflow configurations, or multiple development tools.
You can store and manage credentials centrally, organize them by project and factory, and use them across your authorized application components.
Most importantly, **you can build with AI without handing your secret values to the AI agent**.
Rumata separates credential management from AI-generated development, giving you both flexibility and control over how your applications connect to external services.
## Related guides
- [Secret controls](https://docs.rumata.dev/guides/controls-secrets)