> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets management

> Where Orq.ai stores API Keys, provider credentials, secret variables, and signing secrets, who can read each one, and how to rotate it.

**Orq.ai** stores, exposes, and rotates each kind of secret differently. The table below maps each one and links to the page that owns it.

## Where each secret lives

| Secret | Stored as | Readable by | Rotation |
| - | - | - | - |
| [**API Keys**](/ai-studio/organization/api-keys) (`sk-orq-…`) | SHA-256 hash and displayable prefix | Create response only | Create a replacement, then revoke the old |
| [**Management Keys**](/ai-studio/organization/management-keys) | SHA-256 hash and displayable prefix | Create response only; admin-only page | Create a replacement, then revoke the old |
| [Provider keys](/ai-gateway/providers-overview) (BYOK) | Encrypted with a workspace key | Never returned; masked on read | Update the key on the provider panel |
| [Secret variables](/ai-studio/ai-engineering/run-agents) in runs and [schedules](/ai-studio/ai-engineering/schedule-agents) | Plain text in the schedule payload | Anyone who can read the schedule | Store the payload again |
| [Notifier webhook headers](/ai-studio/observability/notifiers#secret-headers) | Plain text | Returned empty only when marked `{"secret": true}` | Update the header |
| [Webhook signing secret](/ai-studio/organization/webhooks) | Plain text | Create response only; masked on read | Generate a new secret, then update the webhook |
| [MCP server credentials](/ai-gateway/mcp-portal/mcp-servers) | Encrypted with a workspace key | Never returned; masked preview | Update in the server settings |
| [SSO credentials](/ai-studio/organization/sso) | Encrypted with a workspace key | Never returned | Re-enter the credential |
| [External knowledge base key](/ai-studio/ai-engineering/external-knowledge-bases) | Encrypted with a workspace key | Never returned | Update the key |

## Keeping secret variables out of traces

Mark a variable as secret with `{"secret": true, "value": "..."}`, as described in [Run agents](/ai-studio/ai-engineering/run-agents). **Orq.ai** substitutes the value into instructions and tool headers, then redacts it wherever the run is recorded:

* Traces and span attributes: the value is replaced with `***`.
* Stored response variables: the secret key is removed.
* The live response: still contains the rendered value.

<Warning>
  A secret variable redacts its value at run time only. A value stored in a schedule payload, a notifier header, or a webhook definition stays readable wherever that resource is readable.
</Warning>

For content-level masking of request and response bodies, see [Mask sensitive content in traces](/ai-gateway/features/security).

## Encryption at rest

* **Encrypted with a workspace key** (AES-256-GCM): provider, MCP server, SSO, and external knowledge base credentials. A database read alone does not disclose them.
* **Hashed**: API Keys and Management Keys store a SHA-256 hash and a displayable prefix, never the token.
* **Plain text**: schedule payload variables, notifier headers, and webhook signing secrets. Schedule payload variables rely on access control alone; notifier headers are masked on read only when marked `{"secret": true}`, and webhook signing secrets are always masked on read.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.