---
title: Secrets
sidebar:
  order: 19
---
## Overview

A **secret** in Roboto holds sensitive information like an API key, a password, or another credential in a dedicated secret store. [Actions](/docs/learn/concepts#actions-section) use secrets during execution without the values passing through Roboto's APIs.

Each secret is scoped to an organization and has a unique name within that organization.

You set a secret's value when you create it. Neither the web UI nor the CLI displays that value afterward: both show only the secret's name and metadata. The SDK still reads values, which is how an action resolves a secret parameter at runtime.

## Creating Secrets

You can create secrets through the web UI, CLI, or SDK.

**Web UI:**

Open Settings, go to the Secrets tab, and add a secret with its name and value.

**CLI:**

```bash
roboto secrets write my-api-key <secret-value>
```

**SDK:**

```python
from roboto import Secret

# Create a new secret
secret = Secret.create(
    name="my-api-key",
    initial_value="sk-1234567890abcdef"
)
```

## Using Secrets in Actions

Actions can access secret values in two ways:

1. **Parameter References** (Recommended)

   Reference secrets in action parameters using the `roboto-secret://` URI format:

   ```python
   # When invoking an action
   action.invoke(
       input_data=[file_name],
       parameter_values={
           "api_key": "roboto-secret://my-api-key"
       }
   )
   ```

   Or if you are using the web UI, you can reference the secret in the parameters section of the action invocation:

   ![Secret Parameter Reference](/docs/blume-assets/content/docs/_static/secret-param-ref.png)

   In your action code, access the resolved value:

   ```python
   from roboto import InvocationContext

   context = InvocationContext.from_env()
   api_key = context.get_parameter("api_key")  # Automatically resolved
   ```

2. **Direct Access**

   Load secrets directly in action code:

   ```python
   from roboto import Secret

   secret = Secret.from_name("my-api-key")
   api_key = secret.read_value().get_secret_value()
   ```

## Secret URIs

Secrets can be referenced using URIs in the format:

- `roboto-secret://secret-name` (uses caller's organization)
- `roboto-secret://secret-name@org_id` (specific organization)

These URIs can be used anywhere a secret reference is needed, such as action parameters.

## Managing Secrets

**List secrets:**

```bash
roboto secrets list
```

If you belong to more than one organization, pass `--org` to choose one.

**Delete a secret:**

```bash
roboto secrets delete my-api-key
```

## Security

- Secret values are stored in a secure secret store, not in Roboto's databases
- Values are never transmitted through Roboto's APIs
- Actions access secrets using temporary, scoped credentials

See the [roboto secrets CLI](/docs/reference/cli#roboto-secrets) for additional CLI information.