Credential handling
Where an agent's secrets are stored, the one path that puts a value in the vault without the model reading it, and how platform keys are kept.
Agent secrets
A credential your agent needs -- such as an API key for a booking system -- is stored as a secret variable.
| Store | What it holds |
|---|---|
| The variable record | A pointer, and nothing else |
| An encrypted vault | The value itself |
Access
Vault access is narrowly scoped -- nothing that serves ordinary requests can read it directly. When access is denied, the read returns nothing rather than an error, so the existence of a secret is not disclosed.
Deleting a variable deletes the stored value with it. Vault contents are mirrored to a separate encrypted store in the same Australian region for recovery.
How a secret reaches the vault
One path keeps a credential out of the language model: the dialog. The in-app assistant asks for a secret by name, you type the value into a dialog, and the dialog submits it straight to the vault. The value never enters the assistant's context.
The assistant gets back a confirmation carrying the variable's name and nothing else -- no tool on that path takes the value itself.
The workspace assistant cannot do it
The workspace assistant works across agents rather than one open agent. It does not render the dialog, so it cannot put a value in the vault. It can still write plain fields, so it is not a safe place to paste a credential either.
What the dialog protects you from
The chat itself. Anything typed into a conversation is read by the model before any tool runs. Several agent fields also store values exactly as written:
- The default value of a variable.
- A tool's request headers.
- A tool's endpoint URL.
Ask for a credential to be put in one of those and it can end up stored in the clear. The assistant refuses some such requests and names the placeholder to send instead, but the refusals recognise a credential by its shape -- and a credential does not always have one. The dialog is the only path we guarantee: the value goes from your keyboard to the vault without passing through the model.
If you have already pasted a credential into a chat
Rotate it, and check the agent's variables and its tools for a copy left behind.
The MCP server and the operations API
Both accept a secret value directly -- the caller supplies it deliberately and there is no dialog to render. The value transits whatever client sent it.
Platform keys
API keys and publishable keys are stored as hashes. The raw value is shown once at creation and cannot be retrieved afterwards.