Skip to main content
SEAOTTER Secrets are write-only integration keys for a hosted Hermes agent: you paste once, SEAOTTER stores the value in Google Secret Manager, and Hermes loads it at startup. The value is never shown again. Do not paste keys into chat when you can use this tab. Integration keys (OpenAI, Anthropic, Composio, and similar) belong on the agent Secrets tab—not in Config, and not pasted into chat history when you can avoid it. Hermes recommends loading provider keys from an external secret manager at process startup instead of storing them in .env. SEAOTTER follows that path: keys you save here live in Google Secret Manager. Hermes loads them at startup. They are not written to the agent’s persistent .env.
  1. Open the agent → Secrets.
  2. Choose Add secret (or Replace on an existing key).
  3. Optionally pick a provider preset (OPENAI_API_KEY, ANTHROPIC_API_KEY, and others) or type a custom key name.
  4. Paste the value once. Save.
After save, SEAOTTER never shows the value again. The list shows key names and status only. Replace if you need a new value; delete removes the key from the agent. Workspace members can view metadata when allowed by role, but cannot add, replace, or delete secrets. Admins see a clear read-only message—not a bare 403.

​
After you save

Running agents briefly restart so Hermes picks up the new environment. The dashboard may be unavailable for a short window (usually under two minutes). Wait for the applying / warming banner to clear before opening Hermes. SEAOTTER stores the value in Google Secret Manager. After that restart, Hermes loads the key as an environment variable so tools and integrations can use it. Prefer Secrets over Config and over pasting keys into chat.

​
Config is not for secrets

The Config tab is for non-secret settings (model names, allowlists, and similar). Keys that look like secrets (API_KEY, TOKEN, PASSWORD, …) are blocked there. Store them under Secrets instead.

​
From chat (MCP)

With a SEAOTTER access key (so_…) connected from seaotter.dev/connect, you can call upsert_secret / delete_secret. Prefer the dashboard Secrets UI for highly sensitive material—values pasted into chat may remain in that chat’s history.
No. SEAOTTER follows Hermes’ external-secret-manager path: values live in Google Secret Manager. Hermes loads them as environment variables at startup. They are not written to the persistent .env.
No. The list shows key names and status only. Replace to set a new value; delete removes the key from the agent.