secrets
Installation
SKILL.md
Secrets Registry
Non-negotiable rule
Never hardcode credential values. Source, docs, tests, fixtures, prompts, seed
data, and generated extension/app content may mention credential names such
as OPENAI_API_KEY, but must not contain real API keys, tokens, webhook URLs,
signing secrets, OAuth refresh tokens, or private Builder/customer data.
Secret values are supplied at runtime through deployment configuration, the
encrypted app_secrets vault, saveCredential / resolveCredential, OAuth, or
${keys.NAME} substitution. Examples must use obvious placeholders such as
<OPENAI_API_KEY> or ${keys.SLACK_WEBHOOK}, not real-looking copied values.
When to use
Use this for any external credential your template needs: API keys, service tokens, webhook secrets. It gives you: