Skip to main content

​
Introduction

Secrets let you store sensitive values such as API keys, access tokens, and other credentials once, then reference them by name. Your tools use the value without exposing it in plaintext. Secrets are organization-wide. Store one and every agent can use it.

​
Where secrets live

Set the sidebar selector to All agents, open Tools under Resources, and select the Secrets tab. Each row shows the secret’s name, its reference with a copy button, and whether it is Static or Refresh. Add Secret creates one. Creating a secret needs the owner, admin, or operator role. Without one, Add Secret is visible but disabled.

​
Secret types

​
Static secrets

A value you paste in, like an API key. It changes only when you change it. Fields required:
  • Secret name (used to reference the value)
  • Secret value (stored encrypted)

​
Refreshable secrets

A value Bland fetches from an external service on a schedule, so the agent never holds an expired token mid-call. Fields required:
  • Name
  • Webhook URL
  • HTTP request type (GET or POST)
  • Headers (optional)
  • Body (if using POST)
  • Refresh interval, from 10 minutes to 24 hours
  • JSON path for extracting the secret value from the response
Set the interval shorter than the token’s lifetime.
For refreshable secrets, URL encode all parameters and include them directly in the webhook URL. Parameters sent in the request body or through content-type headers are not currently supported.

​
Referencing secrets

There are three ways to use a secret in a tool. Authorization tab. In the tool builder, choose Bearer Token or API Key on the Authorization tab, then pick a secret. Create New Secret in the picker opens the same dialog without leaving the tool. Headers. Copy the reference from the secret’s row on the Secrets tab and paste it into a header value. The copied reference points at the secret by ID, so renaming the secret does not break it. Body. Write the name form instead:
Replace NAME with the secret’s name. A body does not resolve the copied ID reference: it reaches your endpoint as literal text, and the builder’s test still passes. Because the name form uses the name, renaming the secret breaks it. See Store credentials as secrets for more detail.

​
Managing secrets

  • Value: never shown again after you save it.
  • Rename: header references keep working. Body references use the name, so update them too.
  • Delete: removes the secret permanently.

​
Best practices

  • Use lowercase, underscore-separated names (for example, slack_token)
  • Never paste secrets directly into plaintext inputs
  • Use refreshable secrets for short-lived tokens
  • Rotate static secrets regularly
Docs for agents: llms.txt