Secrets and security
Manage sensitive values and access for people, integrations, and agent work.
Environment secrets
In project settings, use Environment for values that sandbox code needs. Mark sensitive variables as secrets. Saved secrets are hidden in the settings form, but are available to code running in the project's sandboxes.
Keep secret values out of source files and thread messages. Update the stored variable when a value changes.
Credentials and connections
Project Credentials stores credentials for use by automations and runs. Ordinary credential views return metadata without secret values; authorized runtime use can retrieve the values it needs.
Connections links external service accounts. The connected account and the permissions granted by its provider affect which data and actions are available.
Members and API keys
Workspace roles control access to workspace resources and administration. Use a service account when an integration needs its own identity.
In workspace settings, API keys lets you create a key for your user or a service account and delete keys that are no longer needed. Treat an API key as a credential for its identity.
Tool permissions
Project settings > Agent lets you choose connected apps and enable fine-grained tool permissions. When enabled, these permissions can allow, deny, or require approval for specific connected-app tools and argument patterns.
Approval requirements depend on the tool and configuration. Asking the agent to check with you is useful guidance, but does not replace access controls. Apps you build also need appropriate authorization for their own data and actions.