Skip to main content
Orq.ai stores, exposes, and rotates each kind of secret differently. The table below maps each one and links to the page that owns it.

​
Where each secret lives

​
Keeping secret variables out of traces

Mark a variable as secret with {"secret": true, "value": "..."}, as described in Run agents. Orq.ai substitutes the value into instructions and tool headers, then redacts it wherever the run is recorded:
  • Traces and span attributes: the value is replaced with ***.
  • Stored response variables: the secret key is removed.
  • The live response: still contains the rendered value.
A secret variable redacts its value at run time only. A value stored in a schedule payload, a notifier header, or a webhook definition stays readable wherever that resource is readable.
For content-level masking of request and response bodies, see Mask sensitive content in traces.

​
Encryption at rest

  • Encrypted with a workspace key (AES-256-GCM): provider, MCP server, SSO, and external knowledge base credentials. A database read alone does not disclose them.
  • Hashed: API Keys and Management Keys store a SHA-256 hash and a displayable prefix, never the token.
  • Plain text: schedule payload variables, notifier headers, and webhook signing secrets. Schedule payload variables rely on access control alone; notifier headers are masked on read only when marked {"secret": true}, and webhook signing secrets are always masked on read.