API keys and secrets

API keys and secrets

Store server keys by name; the assistant sees only the name and a description, and delivers them to your backend's functions.

Updated Oct 11, 2026

API keys and secrets in Server: a Name such as OPENAI_API_KEY, the Value, what it is for, and Save secret — Name the key as your server code reads it; the value is stored encrypted and never shown again.

Steps

Create the key in the provider's dashboard.
Click Server › API keys & secrets.
Name it as your server code reads it, in UPPERSNAKECASE such as OPENAI_API_KEY, and add a one-line description.
Paste the value and save. To rotate it, replace the entry.

Then ask for the call in a function, not in the app:

Summarize notes with OpenAI in an Edge Function using OPENAI_API_KEY.

Good to know

Secrets reach your code only as Supabase Edge Function secrets, in Firebase Secret Manager (Blaze plan) or as Cloudflare Worker secrets. They never go into the mobile app.
The value is stored encrypted and never shown again, to you or the assistant.
Up to 50 entries per project. A key and its separate organization ID are two entries.