Skip to main content
Any credential your app needs — a Stripe key, an OpenAI key, a vendor signing secret — lives in your project’s secret store, encrypted, and scoped to your project alone. It is never written into the code, never committed, and never pasted into the chat.

​
How secrets get in

  • You provide them through the secure fields the product shows when a capability needs your secret — for example a webhook signing secret in the Infra tab, or OAuth credentials for social sign-in. The value travels directly to the store; the agent never sees the plaintext.
  • The agent stores platform-generated ones — for example, the signing secret minted for a generic inbound webhook.

​
How your app reads them

Each stored secret is injected into your running app as an environment variable (STRIPE_SECRET_KEY and the like) — the standard pattern every hosting platform and every framework understands. Your code reads process.env.STRIPE_SECRET_KEY; nothing Creator-specific is involved. That also means the code keeps working as-is after a GitHub export — you just set the same environment variables wherever you run it.

​
Good to know

  • Secret values are never echoed back — not to the agent, not in the UI, not in logs. Listing shows key names only.
  • A newly written secret reaches the app’s environment on its next restart or deploy.
  • Secrets can be rotated: the platform can generate a fresh value under the same key. Revoking the old value at the vendor (e.g. in the Stripe dashboard) is still your step.
  • Isolation is structural: your project’s secrets live under your project’s own path in the encrypted store, and no other project’s app can reach them.