Skip to main content
Secrets are private values, such as an API key or token, that a website’s server functions read as env.NAME. They never reach the browser.

​
Prerequisites

  • Full editor access to the website (the websiteSecrets.manage capability).

​
Add a secret

1

Open the website's settings

In the studio, open Settings and find Secrets.
2

Add the secret

Choose Add secret, enter the name the function reads (letters, numbers, and underscores, such as CRM_API_KEY), paste the value, and save. Values can be up to 16,384 characters.
3

Use it in a function

Read it as env.CRM_API_KEY. Drafts and the live site use the same value, so you can test on the draft before publishing.
When the Cactal agent needs a secret, it asks in the chat with a masked field. What you type is saved straight to the website’s secrets; the agent never sees it.

​
How secrets are kept

  • Values are encrypted at rest and can’t be viewed after saving, through the dashboard, the API, or MCP. To change one, replace it.
  • Each name has one value, shared by drafts and the published site.
  • Secrets move with a transferred website and are destroyed when the website is permanently deleted.
  • A website holds up to 100 secrets.

​
API

  • GET /v1/websites/{websiteId}/secrets lists names and when each was last updated, never values.
  • PUT /v1/websites/{websiteId}/secrets/{name} with { "value": "..." } adds or replaces a secret.
  • DELETE /v1/websites/{websiteId}/secrets/{name} removes one; functions then read undefined.
MCP lists secret names but never sets values; MCP agents send the user to website settings instead.