> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpcore.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Store API keys, passwords, and tokens securely. Reference them in code as env.KEY_NAME — never visible in logs or version control.

## What are secrets?

**Secrets** are encrypted key-value pairs stored on your MCPCore server. They let you use sensitive credentials in tool code without hardcoding them.

Instead of writing:

```javascript theme={null}
// Never do this
const res = await sdk.http({
  headers: { Authorization: "Bearer ghp_myActualTokenHere" },
  ...
});
```

You store the token as a secret and reference it as:

```javascript theme={null}
// Correct
const res = await sdk.http({
  headers: { Authorization: `Bearer ${env.GITHUB_TOKEN}` },
  ...
});
```

Secrets are:

* **Encrypted at rest** with AES-256
* **Not exposed to the AI** — secret values are never sent to the AI client or included in the MCP protocol layer
* **Per-server** — secrets on one server are not accessible from another
* **Not version-controlled** — they live in the dashboard, not in your code

***

## Adding a secret

<Steps>
  <Step title="Open the Secrets tab">
    On the server detail page, click the **Secrets** tab.
  </Step>

  <Step title="Click Add secret">
    Click **Add secret**.
  </Step>

  <Step title="Enter the key and value">
    | Field     | Description                                                                           |
    | --------- | ------------------------------------------------------------------------------------- |
    | **Key**   | The name you'll reference in code as `env.KEY`. Use UPPER\_SNAKE\_CASE by convention. |
    | **Value** | The secret value. Encrypted immediately on save.                                      |
  </Step>

  <Step title="Save">
    Click **Save secret**. The value is encrypted and stored. You can update or delete the secret later, but you cannot view the value after saving.
  </Step>
</Steps>

***

## Referencing secrets in code

Access secrets through the `env` object using the key name you defined:

```javascript theme={null}
// Single API key
const apiKey = env.OPENAI_API_KEY;

// Database credentials
const db = await sdk.db({
  type: "pg",
  connection: {
    host:     env.DB_HOST,
    port:     env.DB_PORT,
    database: env.DB_NAME,
    user:     env.DB_USER,
    password: env.DB_PASSWORD,
  },
});

// OAuth token (injected after OAuth flow)
const res = await sdk.http({
  method:  "GET",
  url:     "https://api.github.com/user/repos",
  headers: { Authorization: `Bearer ${env.OAUTH_ACCESS_TOKEN}` },
});
```

***

## Naming conventions

MCPCore has no enforced naming convention, but UPPER\_SNAKE\_CASE is standard and makes secrets easy to distinguish from regular variables:

| Example key         | What it stores                               |
| ------------------- | -------------------------------------------- |
| `GITHUB_TOKEN`      | GitHub personal access token or app token    |
| `OPENAI_API_KEY`    | OpenAI API key                               |
| `DB_PASSWORD`       | Database password                            |
| `STRIPE_SECRET_KEY` | Stripe secret key                            |
| `SLACK_BOT_TOKEN`   | Slack bot token                              |
| `SENDGRID_API_KEY`  | SendGrid API key                             |
| `WEBHOOK_SECRET`    | HMAC signing secret for webhook verification |

***

## Updating a secret

To rotate a credential:

1. Open the **Secrets** tab
2. Click the edit icon next to the secret
3. Enter the new value
4. Click **Save**

The new value takes effect immediately — no redeploy needed. Running tool invocations will use the new value on their next execution.

***

## Deleting a secret

Click the delete icon next to the secret and confirm. Any tool code that references the deleted key will receive `undefined` for `env.DELETED_KEY`. Update the tool code to remove the reference, or add a new secret with the same key name.

***

## Secret visibility

| Who can see secrets     | Access level                                                        |
| ----------------------- | ------------------------------------------------------------------- |
| Tool code               | `env.KEY_NAME` (value only, not key list)                           |
| Dashboard — Secrets tab | Key names only; values are masked                                   |
| Logs (Traffic, Error)   | Only if you explicitly `console.log()` them — never log raw secrets |
| MCPCore support         | Never — we cannot decrypt your secrets                              |