Secrets

What are secrets?

Secrets are encrypted key-value pairs stored on your MCPCore server. They let you use sensitive credentials in tool code without hardcoding them. Instead of writing:

// Never do this
const res = await sdk.http({
  headers: { Authorization: "Bearer ghp_myActualTokenHere" },
  ...
});

You store the token as a secret and reference it as:

// Correct
const res = await sdk.http({
  headers: { Authorization: `Bearer ${env.GITHUB_TOKEN}` },
  ...
});

Secrets are:

Encrypted at rest with AES-256
Not exposed to the AI — secret values are never sent to the AI client or included in the MCP protocol layer
Per-server — secrets on one server are not accessible from another
Not version-controlled — they live in the dashboard, not in your code

Adding a secret

Open the Secrets tab

On the server detail page, click the Secrets tab.

Click Add secret

Click Add secret.

Enter the key and value

Field	Description
Key	The name you’ll reference in code as `env.KEY`. Use UPPER_SNAKE_CASE by convention.
Value	The secret value. Encrypted immediately on save.

Save

Click Save secret. The value is encrypted and stored. You can update or delete the secret later, but you cannot view the value after saving.

Referencing secrets in code

Access secrets through the env object using the key name you defined:

// Single API key
const apiKey = env.OPENAI_API_KEY;

// Database credentials
const db = await sdk.db({
  type: "pg",
  connection: {
    host:     env.DB_HOST,
    port:     env.DB_PORT,
    database: env.DB_NAME,
    user:     env.DB_USER,
    password: env.DB_PASSWORD,
  },
});

// OAuth token (injected after OAuth flow)
const res = await sdk.http({
  method:  "GET",
  url:     "https://api.github.com/user/repos",
  headers: { Authorization: `Bearer ${env.OAUTH_ACCESS_TOKEN}` },
});

Naming conventions

MCPCore has no enforced naming convention, but UPPER_SNAKE_CASE is standard and makes secrets easy to distinguish from regular variables:

Example key	What it stores
`GITHUB_TOKEN`	GitHub personal access token or app token
`OPENAI_API_KEY`	OpenAI API key
`DB_PASSWORD`	Database password
`STRIPE_SECRET_KEY`	Stripe secret key
`SLACK_BOT_TOKEN`	Slack bot token
`SENDGRID_API_KEY`	SendGrid API key
`WEBHOOK_SECRET`	HMAC signing secret for webhook verification

Updating a secret

To rotate a credential:

Open the Secrets tab
Click the edit icon next to the secret
Enter the new value
Click Save

The new value takes effect immediately — no redeploy needed. Running tool invocations will use the new value on their next execution.

Deleting a secret

Click the delete icon next to the secret and confirm. Any tool code that references the deleted key will receive undefined for env.DELETED_KEY. Update the tool code to remove the reference, or add a new secret with the same key name.

Secret visibility

Who can see secrets	Access level
Tool code	`env.KEY_NAME` (value only, not key list)
Dashboard — Secrets tab	Key names only; values are masked
Logs (Traffic, Error)	Only if you explicitly `console.log()` them — never log raw secrets
MCPCore support	Never — we cannot decrypt your secrets

Getting Started

MCP Servers

Tools

Observability

Connect AI Clients

What are secrets?

Adding a secret

Referencing secrets in code

Naming conventions

Updating a secret

Deleting a secret

Secret visibility

​What are secrets?

​Adding a secret

​Referencing secrets in code

​Naming conventions

​Updating a secret

​Deleting a secret

​Secret visibility

What are secrets?

Adding a secret

Referencing secrets in code

Naming conventions

Updating a secret

Deleting a secret

Secret visibility