Secrets management

Agent Apps has two levels of secrets:

System secrets

Per-app, shared across all installations. Typically API keys or service account credentials that are the same for all users.

User secrets

Per-installation + per-tenant. Typically OAuth tokens or per-user API keys that are unique to each user.

How to set secrets

Always use the CLI:

agentapps config app.github GITHUB_TOKEN:ghp_xxx

Never write .secrets/ files directly — the Station resolves secrets via callbacks to ensure they are never exposed to the app source.

Security best practices

• Secrets are stored locally in .agentapps/user-secrets/<alias>.json
• The Station injects secrets via ctx.secrets.getSystem / ctx.secrets.getUser callbacks
• Apps never read secret files directly
• Add .agentapps/ to .gitignore

Next steps

• Multi-tenancy — tenant isolation
• Authenticate — user-side auth setup