> ## Documentation Index
> Fetch the complete documentation index at: https://outcrawl.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Store a credential under a name an agent can reference but never read.

export const OutcrawlStyles = () => {
  if (typeof document !== 'undefined' && !document.getElementById('outcrawl-overrides')) {
    const s = document.createElement('style');
    s.id = 'outcrawl-overrides';
    s.textContent = `
      /* Match the product's radius grid (4 / 6 / 8 / 9999), not Mintlify's default. */
      .rounded-sm { border-radius: 0.375rem !important; } /* 6px, --r-ctl */
      .rounded-md { border-radius: 0.375rem !important; } /* 6px, --r-ctl */
      .rounded-lg { border-radius: 0.5rem !important; }   /* 8px, --r-panel */
      .rounded-l-sm { border-top-left-radius: 0.375rem !important; border-bottom-left-radius: 0.375rem !important; }
      .rounded-r-sm { border-top-right-radius: 0.375rem !important; border-bottom-right-radius: 0.375rem !important; }
      .rounded-l-md { border-top-left-radius: 0.375rem !important; border-bottom-left-radius: 0.375rem !important; }
      .rounded-r-md { border-top-right-radius: 0.375rem !important; border-bottom-right-radius: 0.375rem !important; }
      .rounded-l-lg { border-top-left-radius: 0.5rem !important; border-bottom-left-radius: 0.5rem !important; }
      .rounded-r-lg { border-top-right-radius: 0.5rem !important; border-bottom-right-radius: 0.5rem !important; }

      /* Cards: never pure white in light mode, matching the one-big-card surface tone. */
      .card { background-color: #fcfcfc !important; border-radius: 0.5rem !important; }
      html.dark .card { background-color: #141311 !important; }

      /* Docs hero box */
      .oc-hero { background-color: #fcfcfc; border: 1px solid #e5e2dc; }
      html.dark .oc-hero { background-color: #141311; border-color: #26241f; }
      html.dark .oc-hero h1 { color: #edeae4; }

      /* Thin, transparent-track, hide-until-hover scrollbar. */
      ::-webkit-scrollbar { width: 6px; height: 6px; background-color: transparent; }
      ::-webkit-scrollbar-track { background-color: transparent; }
      ::-webkit-scrollbar-thumb { background-color: rgba(155, 155, 155, 0.5); border-radius: 10px; transition: opacity 0.3s ease; opacity: 0; }
      ::-webkit-scrollbar-thumb:hover { background-color: rgba(155, 155, 155, 0.7); }
      *:hover::-webkit-scrollbar-thumb,
      *:focus::-webkit-scrollbar-thumb,
      *:active::-webkit-scrollbar-thumb { opacity: 1; }
      * { scrollbar-width: thin; scrollbar-color: rgba(155, 155, 155, 0.5) transparent; }
    `;
    document.head.appendChild(s);
  }
  return null;
};

<OutcrawlStyles />

Store a credential, a card, an environment variable, under a name a run can reference. No surface, API, SDK, CLI or console, ever reads a stored value back. A run reaches it only by naming it; the substitution happens below the model, which never sees the raw value.

<CodeGroup>
  ```typescript TypeScript theme={"theme":{"light":"github-light","dark":"catppuccin-mocha"}}
  import { Outcrawl } from '@outcrawl/sdk';

  const oc = new Outcrawl();
  const secret = await oc.secrets.create({ handle: 'card_amex', kind: 'card', value: '...' });
  const secrets = await oc.secrets.list(); // names and a card's last four, never a value
  ```

  ```python Python theme={"theme":{"light":"github-light","dark":"catppuccin-mocha"}}
  import asyncio
  from outcrawl import Outcrawl

  async def main() -> None:
      async with Outcrawl() as oc:
          secret = await oc.secrets.create(handle="card_amex", kind="card", value="...")
          secrets = await oc.secrets.list()  # names and a card's last four, never a value

  asyncio.run(main())
  ```

  ```bash CLI theme={"theme":{"light":"github-light","dark":"catppuccin-mocha"}}
  outcrawl secrets create card_amex --kind card
  # Prompts for the value, hidden, when this runs in a terminal.

  echo -n "$CARD_NUMBER" | outcrawl secrets create card_amex --kind card
  # Reads the value from stdin instead, when the command is piped.
  ```

  ```bash curl theme={"theme":{"light":"github-light","dark":"catppuccin-mocha"}}
  curl -X POST https://api.outcrawl.ai/v1/secrets \
    -H "Authorization: Bearer ock_YOUR_KEY_ID.YOUR_SECRET" \
    -H "Content-Type: application/json" \
    -d '{"handle": "card_amex", "kind": "card", "value": "..."}'

  curl https://api.outcrawl.ai/v1/secrets -H "Authorization: Bearer ock_YOUR_KEY_ID.YOUR_SECRET"
  ```
</CodeGroup>

<Note>
  This has no MCP tool, deliberately. An assistant must never manage a credential itself; a model that could create, list or delete one is one convincing page away from moving somebody's money. A secret is created from the CLI or an SDK, straight to the platform; the console at [https://outcrawl.ai/console/secrets](https://outcrawl.ai/console/secrets) lists what is stored and revokes it, and neither surface ever holds a value. An agent still uses one, at runtime, by naming it, the one it was given at submit time.
</Note>

`secrets.list` returns names and, for a card, its last four digits, and nothing else. `secrets.delete` takes effect the next time a run would type the value, not at the end of the run: a run that was given a deleted secret finds it gone and stops, naming it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.