> ## Documentation Index
> Fetch the complete documentation index at: https://docs.servflow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> What a secret is: a token or key stored once under a name, used by that name, and never shown again

A secret is a sensitive value, such as a bot token, stored once under a name. Everywhere else you use the name. The value is never shown again, not even to you. This page is for anyone holding a token or key and wondering where it goes.

![The Secrets page listing secrets by name, with no values shown](https://mintcdn.com/servflow/Tigm2DtWfuvgudby/images/concepts/secrets/01-secrets.png?fit=max\&auto=format\&n=Tigm2DtWfuvgudby\&q=85\&s=c422a4abfcb5592d4b920deaaa28d31c)

## Why use a secret

A token is typed once. It does not appear in an agent's settings, or in a config file you might share. And when it has to be replaced, you replace it in one place.

## Where secrets are used

* **In an integration.** A sensitive field, such as a Discord bot's token, takes a secret chosen from a list. See [Integrations](https://docs.servflow.io/concepts/integrations.md).
* **In a prompt or a tool's settings.** Write `{{ secret "name" }}` where the value should go, for example an API key in a web request that a tool makes. By default, ServFlow checks an environment variable with that exact name before it checks the stored secret. Set `[secrets].disable_env = true` to skip environment lookup. See [Dynamic content](https://docs.servflow.io/concepts/dynamic-content.md) and [Configuration](https://docs.servflow.io/references/configuration.md#secrets).

One thing is not a secret: a provider's API key. You type that into the provider itself. See [Providers](https://docs.servflow.io/concepts/providers.md).

## You can replace a secret, not read it

Once saved, the value is not shown anywhere. If you lose the original, create a new token with the service it came from, and replace the secret's value.

A secret's name cannot be changed. It is also the secret's identity in the dashboard and API, so use letters, digits, underscores, dots, or hyphens only. If you need a different name, create a new secret.

## When a change takes effect

| Where the secret is used | When the new value is used |
| - | - |
| In a prompt or a tool's settings | The next time the agent runs |
| In an integration | As soon as you save or delete the secret |
| In an entry's settings | After you next save an agent |

So after you replace a token that an integration uses, ServFlow updates integrations that name it. If an entry depends on that integration, save the agent too.

## Deleting a secret

Whatever uses a deleted secret fails the next time it runs, and ServFlow cannot tell you in advance what that is. Check your integrations and prompts first.

## Secrets in the dashboard

**Secrets**, in the sidebar under **Configure**, lists your secrets by name, never by value. Click **New Secret** to add one. In an integration's dialog, a sensitive field lists your secrets, and **Use a stored secret instead** switches an ordinary field over to one.

![An integration dialog with a stored secret chosen for the private key field](https://mintcdn.com/servflow/xWuDwV6ivYm_bf7G/images/guides/add-an-integration/04-edit-dialog.png?fit=max\&auto=format\&n=xWuDwV6ivYm_bf7G\&q=85\&s=7c80d9b06d91137d03b80f5a37371a73)

## Related

> [card] [Add an integration](https://docs.servflow.io/guides/add-an-integration.md)
>
> Use a secret in an integration's field.

> [card] [Integrations](https://docs.servflow.io/concepts/integrations.md)
>
> What an integration is and where it is used.

> [card] [Providers](https://docs.servflow.io/concepts/providers.md)
>
> Where a model company's key goes.

> [card] [Configuration](https://docs.servflow.io/references/configuration.md#sqlite)
>
> Where secrets are stored, and how they are encrypted.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.