> ## Documentation Index
> Fetch the complete documentation index at: https://cactal.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage secrets

> Store API keys and tokens for a website's server functions: set them once in website settings, use them as env, and never read them back.

Secrets are private values, such as an API key or token, that a website's [server functions](https://cactal.ai/docs/concepts/server-functions.md) read as `env.NAME`. They never reach the browser.

## Prerequisites

* Full editor access to the website (the `websiteSecrets.manage` capability).

## Add a secret

**1. Open the website's settings**

In the studio, open **Settings** and find **Secrets**.

**2. Add the secret**

Choose **Add secret**, enter the name the function reads (letters, numbers, and underscores, such as `CRM_API_KEY`), paste the value, and save. Values can be up to 16,384 characters.

**3. Use it in a function**

Read it as `env.CRM_API_KEY`. Drafts and the live site use the same value, so you can test on the draft before publishing.

When the Cactal agent needs a secret, it asks in the chat with a masked field. What you type is saved straight to the website's secrets; the agent never sees it.

## How secrets are kept

* Values are encrypted at rest and can't be viewed after saving, through the dashboard, the API, or MCP. To change one, replace it.
* Each name has one value, shared by drafts and the published site.
* Secrets move with a [transferred website](https://cactal.ai/docs/guides/transfer-a-website.md) and are destroyed when the website is permanently deleted.
* A website holds up to 100 secrets.

## API

* `GET /v1/websites/{websiteId}/secrets` lists names and when each was last updated, never values.
* `PUT /v1/websites/{websiteId}/secrets/{name}` with `{ "value": "..." }` adds or replaces a secret.
* `DELETE /v1/websites/{websiteId}/secrets/{name}` removes one; functions then read `undefined`.

MCP lists secret names but never sets values; MCP agents send the user to website settings instead.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.