Secrets

Settings → Secrets (/confluye/{slug}/settings/secrets) is the credential editor: search, name, type, value, Save. Saving calls tRPC settings.createCredential / updateCredential. Values are never shown after save (maskedValue only).

This is the same store as Integrations and credentials. Integrations that need a token write here; workflows resolve {{credential.NAME}} / {{secret.NAME}} from decrypted workspace secrets at run time.

What the UI can do

• Search by name. Empty match: “No workspace secrets match this search.”
• Create a new row (name, type, value). Save stays disabled until name and value are filled.
• Edit existing names/types/values in place, then Save.
• Surface missing workflow credentials from platform doctor (imported n8n/HTTP secrets): Login (OAuth), Client ID / Client secret, or Add.

Security boundaries

• Encryption: AES-256-GCM. Rotate APP_ENCRYPTION_KEY without re-saving credentials makes decrypt fail (SecretDecryptionError); reconnect the secret.
• Run logs redact known secret strings and sk- prefixes as {{REDACTED}}.
• List APIs never return plaintext.
• Personal credentials are not the default Secrets list (scope defaults to workspace).
• Claude Code / Codex subscription secrets are managed from Settings → Workers, not this form.

Limits and failure modes

• Type/value validation errors appear in the page error box (400 / tRPC BAD_REQUEST).
• Duplicate workspace names update the existing credential.
• Doctor OAuth buttons require the integration OAuth client to be configured; otherwise use Client ID/secret first.

Next steps