---
title: "Secrets And Credentials"
description: "Provide credentials and environment-style values to a Gobii through controlled secret flows instead of chat."
sidebar_label: "Secrets And Credentials"
---

Secrets are sensitive values a Gobii may need to use a service: credentials, API keys, tokens, passwords, or environment-style values.

Do not paste secrets into chat messages, files, or public templates. Use Gobii's secrets flows so the value can be stored and scoped intentionally.

## Secret scopes

| Scope | Use it for |
| --- | --- |
| Gobii-scoped secret | A value only one Gobii should use. |
| Global user secret | A reusable personal value available where you explicitly assign it. |
| Organization secret | A team-managed value for organization workflows. |
| System skill profile secret | A value used by an admin-configured system skill profile. |

Available scopes depend on your role and deployment.

## Requested secrets

A Gobii may request a secret when it cannot complete work without one. The request should explain what it needs and why.

Before fulfilling a request:

- Confirm the destination or service.
- Confirm the Gobii actually needs the value.
- Prefer least-privilege credentials.
- Avoid broad admin tokens when a narrower token works.
- Decide whether the secret should stay Gobii-scoped or be promoted for reuse.

## Manage secrets

Global secrets:

- Gobii Cloud: `https://gobii.ai/console/secrets/`
- Self-hosted: `http://localhost:8000/console/secrets/`

Gobii-specific secrets:

- Gobii Cloud: `https://gobii.ai/console/agents/<agent_id>/secrets/`
- Self-hosted: `http://localhost:8000/console/agents/<agent_id>/secrets/`

## Safe operating rules

- Rotate credentials if they may have been pasted into chat or files.
- Remove secrets that are no longer needed.
- Use separate credentials per environment when possible.
- Keep production and testing credentials separate.
- Do not share secrets through public templates.
- Review organization secrets periodically.

## If a Gobii cannot access a service

Check:

- Whether the secret request has been fulfilled.
- Whether the secret is scoped to this Gobii or organization.
- Whether the credential still works at the provider.
- Whether a connected app or OAuth flow is also required.
- Whether the Gobii needs a narrower instruction about when to use the secret.
