# Secrets

> Field reference for the Secrets component in the Agent Gateway dashboard: secret types, fields, and lifecycle operations.
Secrets store encrypted credential values on the gateway so that surfaces and transit points can reference a credential by ID rather than embedding a raw value.

## Overview

A secret holds one encrypted value: an API key, bearer token, password, certificate, or similar credential. Once created, the raw value is never exposed in exported configuration or dashboard forms. Any configuration that needs the credential references the secret by its Secret ID.

This model means rotating a credential requires updating only the secret. Every surface and element that references that Secret ID uses the new value on the next request; no surface update required.

Secrets are used in two common surface configurations:

- Caller authentication (API Key method): the Secret ID field on the API Key source authentication element points to a secret whose value is the expected API key credential. The gateway checks the inbound key against this secret on each request.

- Transit Point target authentication: the Transit Point’s Authentication section references a secret to inject credentials (bearer token, API key header) into outbound calls to the external destination.

For a step-by-step flow that uses a secret for surface access control, see [Restrict surface access with API key authentication](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/restrict-surface-access-with-api-key.md).

## Fields

| Field | Required | Description |
| Name | Yes | A human-readable label, for example OpenAI API key – production. |
| Secret ID | Yes | Auto-generated from the name in slug format. Used when referencing the secret in other configuration. Cannot be changed after the secret is saved. |
| Secret Type | Yes | Describes the kind of credential. See [Secret types](#secret-types) below. |
| Value | Yes | The credential value. Stored encrypted at rest. Not visible after the initial save. |
| Description | No | Optional notes, for example the rotation schedule or the issuing service. |
| Tags | No | Free-form labels for grouping and filtering secrets. |

## Secret types

| Type | Description |
| General | A generic credential not covered by more specific types. |
| ApiKey | An API key credential. |
| DatabasePassword | A database password. |
| Certificate | A certificate-type credential. Note: full certificate objects are managed separately under Certificates in the sidebar. |
| SshKey | An SSH private key. |
| Token | A bearer token or similar token-type credential. |

The type is descriptive only; it does not change how the gateway stores or injects the value.

## Operations

### Create a secret

In the sidebar, select Secrets, then select New Secret. Fill in the required fields and select Save. The Secret ID is auto-generated from the name but can be edited before saving. It cannot be changed afterwards.
Secret hygiene

The secret value is stored encrypted at rest. Do not embed raw credential values in surface configuration or logs. Reference secrets by ID only.

### Update a secret value

Open the secret from the Secrets tab and enable the Update value toggle. Enter the new value and select Save. All surfaces referencing this secret by ID use the new value immediately; no surface update is required.

### Delete a secret

Select the secret from the Secrets tab and select Delete.
Caution

Deleting a secret that is still referenced by an active surface causes those requests to fail at runtime. Confirm no active configuration references the secret before deleting.

## Related

- [Restrict surface access with API key authentication](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/restrict-surface-access-with-api-key.md): end-to-end guide using a secret for Caller Context API key authentication.

- [API keys](/products/affinidi-trust-fabric/agent-gateway/reference/authentication/api-keys.md): surface-scoped API keys that identify individual external clients.