> ## Documentation Index
> Fetch the complete documentation index at: https://wb-21fd5541-workspaces-notebooks.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Overview of W&B secrets, how they work, and how to get started using them.

# Manage secrets

W\&B Secret Manager lets you securely and centrally store, manage, and inject *secrets*, which are sensitive strings such as access tokens, bearer tokens, API keys, or passwords. W\&B features can read team secret values, which removes the need to paste them or store them in code, training scripts, or plain-text automation configuration. This page is for W\&B Admins who need to create, rotate, delete, or manage access to team secrets used by webhook automations, Weave Playground, and sandboxes.

Secrets live in each team's Secret Manager, in the **Team secrets** section of the [team settings](/platform/app/settings-page/teams/).

<Note>
  * Only W\&B Admins can create, edit, or delete a secret.
  * Secrets are included as a core part of W\&B, including in [W\&B Server deployments](/platform/hosting/) that you host in Azure, Google Cloud, or AWS. Connect with your W\&B account team to discuss how you can use secrets in W\&B if you use a different deployment type.
  * In W\&B Server, you are responsible for configuring security measures that satisfy your security needs.

    * W\&B strongly recommends that you store secrets in a W\&B instance of a cloud provider's secrets manager from AWS, Google Cloud, or Azure, which include advanced security capabilities.

    * W\&B recommends against using a Kubernetes cluster as the backend of your secrets store. Use a cluster only if you can't use a W\&B instance of a cloud secrets manager (AWS, Google Cloud, or Azure) and you understand how to prevent the security vulnerabilities that can occur.
</Note>

## Where team secrets are used

You can use team secrets in W\&B in multiple contexts. After you [add a secret](#add-a-secret), a feature like W\&B Automations can access the secret by name.

* **Webhook automations**: When an automation sends an HTTP request to a [webhook](/models/automations/create-automations/webhook/), you can attach team secrets for authentication headers and for values referenced in the payload. You can scope automations to a [project](/models/automations/automation-events/#project) or a [Registry](/models/automations/automation-events/#registry). Registry-scoped automations that call a webhook use the same team webhooks and team secrets as project-scoped webhook automations.
* **Weave Playground**: Supply provider credentials as named team secrets. See [Add provider credentials and information](/weave/guides/tools/playground#add-provider-credentials-and-information).
* **Sandboxes**: Securely provide team secrets to your sandboxes to make them available as environment variables. See [Secrets in sandboxes](/sandboxes/secrets).

## Add a secret

Add a secret when you want to make a sensitive value available to W\&B features without exposing it in code or configuration. After you complete these steps, the secret is available by name to the team features described in [Where team secrets are used](#where-team-secrets-are-used).

To add a secret:

1. If an external service gives you a token or API key, obtain that value through that service's normal flow. If necessary, save the sensitive string securely, such as in a password manager, before you paste it into W\&B Secret Manager. Saving a backup matters because, after creation, W\&B no longer reveals the secret's value.
2. Sign in to W\&B and go to the team's **Settings** page.
3. In the **Team Secrets** section, click **New secret**.
4. Provide a name for the secret, using letters, numbers, and underscores (`_`).
5. Paste the sensitive string into the **Secret** field.
6. Click **Add secret**.

When you configure a webhook for an automation, select which team secrets the webhook may use. For field names, access tokens, and payload variables, see [Create a webhook automation](/models/automations/create-automations/webhook).

<Note>
  After you create a secret, you can access that secret in a [webhook automation's payload](/models/automations/create-automations/webhook/) using the format `${SECRET_NAME}`.
</Note>

## Rotate a secret

Rotate a secret when its value changes (for example, when an upstream credential is regenerated or when you suspect the existing value has been compromised). Because W\&B doesn't reveal a secret's current value after creation, rotation is also the way to replace a value you no longer have a copy of.

To rotate a secret and update its value:

1. Click the pencil icon in the secret's row to open the secret's details.
2. Set **Secret** to the new value. Optionally, click **Reveal secret** to verify the new value.
3. Click **Add secret**. The secret's value updates and no longer resolves to the previous value.

<Note>
  After a secret is created or updated, you can no longer reveal its current value. Instead, rotate the secret to a new value.
</Note>

Rotating or replacing a secret can affect every feature that still expects the old value. Before you rely on the new value everywhere, update [webhook automations](/models/automations/create-automations/webhook), [sandboxes](/sandboxes/secrets) that inject the secret, [Weave Playground](/weave/guides/tools/playground#add-provider-credentials-and-information), or other consumers.

## Delete a secret

Delete a secret when no team feature uses it. Because deletion is immediate and permanent, confirm that no automations, sandboxes, or other consumers still reference the secret before you proceed (see [Manage access to secrets](#manage-access-to-secrets)).

To delete a secret:

1. Click the trash icon in the secret's row.
2. Read the confirmation dialog, then click **Delete**. The secret is deleted immediately and permanently.

## Manage access to secrets

You can reference a team's secrets by name in [webhook automations](/models/automations/create-automations/webhook), [Weave Playground](/weave/guides/tools/playground#add-provider-credentials-and-information), [sandboxes](/sandboxes/secrets), and other team-scoped features that select secrets by name.

Before you remove a secret, update or remove every automation, sandbox configuration, or Playground flow that uses it so they don't stop working.