Manage secrets

Who can do this

Anyone with the User role can create a secret in chat. Managing a Shared secret requires Admin. Permanent deletion requires Admin.

A secret is a stored credential — an API key, an OAuth connection, a database login, or a client-credentials pair — owned by a feature. Workflows, connections, and MCP servers use secrets to reach external systems. The defining rule: a secret’s sensitive values are never displayed anywhere in the product — not to you, not to other members, and not to the agent.

Create a secret

There is no “Add secret” form anywhere in Ronja. Like most resources, secrets are created only in conversation:

1. Open an exploration and tell Ronja what you want to connect — “connect our Postgres” or “I have an API key for our billing tool”.
2. The conversation pauses and a secure credentials card opens just above the message box. Fill it in. Sensitive fields show a 🔒 sensitive badge and a password-style input; values Ronja pre-filled from the conversation carry a “filled by agent — verify” badge (sensitive values are never pre-filled).
3. Click Save credentials and Ronja resumes the same conversation right where she paused. Or click Skip for now to defer entering them — the secret stays pending and Ronja carries on without it.

For OAuth services Ronja shows a Sign in with {Provider} card in the chat instead — you approve access in a popup, and no credential passes through the chat at all.

Find a secret

Each feature lists its secrets in the feature hub, and every secret has a detail page showing: a type chip (API Key, OAuth, Client Credentials, Public Endpoint, or database), Personal or Shared, Live or Archived, and a Configuration card with Type, Dialect (if set), Credentials (“Stored” / “Not set”), Allowed URLs — the only hosts the secret may be used against — and Agent-visible fields, the only fields the agent may reference by name.

What you will never find is a value. Saved fields render only as “● ● ● ● saved” length indicators; only non-sensitive fields such as host, port, and username appear in plain text.

Update or rotate credentials

1. Ask Ronja in chat to update the secret. The credentials card opens above the message box with saved indicators on stored fields.
2. Type new values only into the fields you want to change — “Leave a field blank to keep its existing value.”
3. Click Save credentials.

When an OAuth secret’s authorization expires, the chat card shows “{Service} authorization expired” — click Re-authorize with {Provider} to run the consent popup again.

Scope: Personal vs Shared

A secret has no scope of its own — it inherits the scope of the feature that owns it. In a private feature it is Personal; in an organization-scoped feature it is Shared. To share a secret, you promote its feature as a bundle — see Share and promote.

Archive or delete

Archive (on the detail page) hides the secret from the agent: Ronja no longer finds or uses it in new work. Reverse it any time with Unarchive.

Caution

You cannot archive or delete a secret while other resources still depend on it — the dependents panel on the detail page lists them, and the action stays disabled until they are gone. Deleting from inside the feature moves the secret to the trash: “It will be permanently deleted after 30 days.” You can restore it until then; immediate permanent deletion is Admin-only.