> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seaotter.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Store integration API keys on an agent through the Secrets tab or MCP—write-only, never shown again after save.

SEAOTTER **Secrets** are write-only integration keys for a hosted Hermes agent: you paste once, SEAOTTER stores the value in Google Secret Manager, and Hermes loads it at startup. The value is never shown again. Do not paste keys into chat when you can use this tab.

Integration keys (OpenAI, Anthropic, Composio, and similar) belong on the agent **Secrets** tab—not in Config, and not pasted into chat history when you can avoid it.

Hermes [recommends loading provider keys from an external secret manager at process startup](https://hermes-agent.nousresearch.com/docs/user-guide/secrets/) instead of storing them in `.env`. SEAOTTER follows that path: keys you save here live in Google Secret Manager. Hermes loads them at startup. They are **not** written to the agent's persistent `.env`.

## Dashboard (recommended)

1. Open the agent → **Secrets**.
2. Choose **Add secret** (or **Replace** on an existing key).
3. Optionally pick a provider preset (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, and others) or type a custom key name.
4. Paste the value once. Save.

After save, SEAOTTER **never shows the value again**. The list shows key names and status only. Replace if you need a new value; delete removes the key from the agent.

Workspace **members** can view metadata when allowed by role, but cannot add, replace, or delete secrets. Admins see a clear read-only message—not a bare 403.

### After you save

Running agents briefly restart so Hermes picks up the new environment. The dashboard may be unavailable for a short window (usually under two minutes). Wait for the applying / warming banner to clear before opening Hermes.

SEAOTTER stores the value in Google Secret Manager. After that restart, Hermes loads the key as an environment variable so tools and integrations can use it. Prefer Secrets over Config and over pasting keys into chat.

## Config is not for secrets

The **Config** tab is for non-secret settings (model names, allowlists, and similar). Keys that look like secrets (`API_KEY`, `TOKEN`, `PASSWORD`, …) are blocked there. Store them under Secrets instead.

## From chat (MCP)

With a SEAOTTER access key (`so_…`) connected from [seaotter.dev/connect](https://seaotter.dev/connect), you can call `upsert_secret` / `delete_secret`. Prefer the dashboard Secrets UI for highly sensitive material—values pasted into chat may remain in that chat’s history.

## Related

* [Connect](https://seaotter.dev/connect)
* [Provisioning lifecycle](/guides/provisioning-lifecycle)
* [Keep keys out of chat (blog)](https://seaotter.dev/blog/hosted-hermes-secrets-without-chat-paste)
* [Hermes Secrets](https://hermes-agent.nousresearch.com/docs/user-guide/secrets/) — recommended secret-source path

<AccordionGroup>
  <Accordion title="Are keys stored in the agent .env?">
    No. SEAOTTER follows Hermes’ external-secret-manager path: values live in Google Secret Manager. Hermes loads them as environment variables at startup. They are not written to the persistent `.env`.
  </Accordion>

  <Accordion title="Can I see the value again after save?">
    No. The list shows key names and status only. Replace to set a new value; delete removes the key from the agent.
  </Accordion>
</AccordionGroup>