Named secrets
Named secrets
The Secrets screen holds the keys and passwords other systems need, such as a payment gateway's keys or a mail relay's password. You enter each one once under a short name, then point shops, apps and agents at that name. Nobody can read a value back, including you. Open it from the account menu (your initials, top right) → Secrets.
Seeing which secrets exist needs secrets:read. Entering, replacing and removing them needs secrets:manage, and only a person signed in as themselves can do it.
What you see
| Column | Shows |
|---|---|
| Name | The short name you point things at, such as stripe-test |
| Kind | What it is for (see below) |
| Holds | Which fields it has, never their values |
| Set | When it was last entered |
| Used by | Which module and record refer to it |
"No secrets yet" means none has been added.
Kinds
| Kind | Fields |
|---|---|
| Stripe keys | Publishable key, Secret key, Webhook signing secret (optional) |
| PayPal app credentials | Client ID, Client secret |
| PayPal sandbox buyer (for payment checks) | Sandbox buyer email, Sandbox buyer password |
| Mail relay (SMTP) | Host, Port (25, 465, 587 or 2525), User, Password |
| Backup storage (S3-compatible) | Endpoint URL, Region, Bucket, Access key ID, Secret access key, Prefix (optional) |
| WooCommerce shop | Consumer key and secret, or WordPress user and application password, or both |
| Amazon SES (sending domains) | Access key ID, Secret access key, Region (optional), Bounce topic (optional). Name it aws-ses |
| SMTP2GO (sending domains) | API key, Region (optional). Name it smtp2go |
| Other | Value |
What you can do
Add a secret
- Press Add secret.
- Type a short Name in lower case, such as
stripe-test. - Pick the Kind, and fill in its fields.
- Press Save.
Generate a key
Use this for a key two systems share that nobody needs to type, such as an app's agent key.
- Press Generate a key.
- Type a Name. It must not exist yet.
- Under See it, choose Show it once here or Send it to my Telegram. On Telegram it goes to your private chat, in a message that deletes itself after ten minutes.
This is the one time a value is shown. Either way the key is kept, and anything can use it by name.
Replace a secret
- Press Replace on its row. The name cannot change.
- Enter every field again.
- Press Save. Anything using the secret is told, and checks itself again. The screen says how many were told.
Remove a secret
Press Remove and confirm. Its value is gone for good. Remove is unavailable while something still uses the secret.
Why agents and keys cannot enter one
A value passed to a tool ends up in a log, a prompt or a model's context. So a value only enters MaxSuite through this screen, typed by a person. An agent or API key holding secrets:manage is still refused. Agents refer to secrets by name only. To give an agent a password for a login, use MaxPass: see Public links and sharing.
Who can do what
| What | Permission |
|---|---|
| See the list | secrets:read |
| Add, generate, replace and remove | secrets:manage, as a person signed in as yourself |
For agents
core.secrets lists secrets by name, kind and which fields are present, never a value. core.generateSecret makes a new random key under a name. No tool can write a value you choose.