> For the complete documentation index, see [llms.txt](https://docs.artific.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.artific.nl/en/for-administrators/tools/secret-keys.md).

# Secret keys

Stored credentials that other parts of the platform reference by name. Found under **Organization management → Secret keys**.

## What they are for

Anything that needs a credential (an API tool, a connection to an external system) does not hold that credential itself. It points at a secret key stored here.

That separation matters:

* The value is never shown again after you save it, and is never sent back to a browser.
* Rotating a credential is one edit here, not an edit in every tool that uses it.
* People who configure tools do not need to be given the credential itself.

## Creating a secret key

Choose **Create key**.

| Field           | What to enter                                                                                              |
| --------------- | ---------------------------------------------------------------------------------------------------------- |
| **Name**        | How you will recognise it when selecting it later. Name it after what it opens: `CRM API key`, not `key1`. |
| **Description** | Which system it belongs to, which account it uses, and who to ask about it.                                |
| **Secret key**  | The credential itself.                                                                                     |

## Editing a secret key

You can change the name and description freely.

The value field behaves differently: it is empty when you open the screen and shows *"Leave empty to keep the current value"*. Leaving it empty keeps what is stored. Typing something replaces it.

{% hint style="info" %}
The stored value is write-only. Nobody can read it back through the platform, including you. If you lose a credential, get a new one from the system it belongs to.
{% endhint %}

## Using a secret key

Secret keys are selected, not typed. In an [API tool](/en/for-administrators/tools/api-tools.md), the **Secret key** field is a dropdown of what is stored here, with a **Create secret key** shortcut for when you need a new one mid-flow.

## Rotating a credential

1. Get the new value from the external system.
2. Edit the secret key here and paste the new value.
3. Save.

Every tool referencing it picks up the new value. Nothing else needs changing. Test one of the tools afterwards to confirm.

## Deleting

**Delete key** removes it permanently and cannot be undone.

{% hint style="danger" %}
Check what uses a secret before deleting it. Nothing warns you, and the failure appears later as a tool that has silently stopped working.
{% endhint %}

## Practical advice

* **One secret per credential**, not one shared between systems. It makes rotation and revocation possible.
* **Use scoped, read-only credentials** where the external system offers them.
* **Write a real description.** In a year, `API key 3` will mean nothing to whoever inherits your job.
* **Rotate on schedule**, and always when someone with access leaves.