> ## Documentation Index
> Fetch the complete documentation index at: https://docs.convonexai.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Encrypted, per-project storage for API keys and credentials — never in code, never in chat, never in logs.

Any credential your app needs — a Stripe key, an OpenAI key, a vendor signing
secret — lives in your project's **secret store**, encrypted, and scoped to your
project alone. It is never written into the code, never committed, and never
pasted into the chat.

## How secrets get in

* **You provide them** through the secure fields the product shows when a
  capability [needs your secret](/capabilities#when-a-capability-needs-something-from-you)
  — for example a webhook signing secret in the Infra tab, or OAuth credentials
  for social sign-in. The value travels directly to the store; the agent never
  sees the plaintext.
* **The agent stores platform-generated ones** — for example, the signing secret
  minted for a [generic inbound webhook](/capabilities/webhooks-inbound).

## How your app reads them

Each stored secret is injected into your running app as an environment variable
(`STRIPE_SECRET_KEY` and the like) — the standard pattern every hosting platform
and every framework understands. Your code reads `process.env.STRIPE_SECRET_KEY`;
nothing Creator-specific is involved. That also means the code keeps working
as-is after a [GitHub export](/shipping/export-github) — you just set the same
environment variables wherever you run it.

## Good to know

* Secret values are **never echoed back** — not to the agent, not in the UI, not
  in logs. Listing shows key names only.
* A newly written secret reaches the app's environment on its next restart or
  deploy.
* Secrets can be **rotated**: the platform can generate a fresh value under the
  same key. Revoking the old value at the vendor (e.g. in the Stripe dashboard)
  is still your step.
* Isolation is structural: your project's secrets live under your project's own
  path in the encrypted store, and no other project's app can reach them.