Org Secrets

Org secrets are encrypted key-value pairs defined once for an org and shared with the projects that need them. A shared credential, such as a warehouse password or a model provider API key, is stored in one place instead of being copied into every project that uses it.

An org secret reaches a project only after it is linked to that project. Storing a secret at the org level does not expose it to every project in the org.

Once a secret is saved, its value cannot be read back through Spice Cloud. The portal lists only the secret name and when it was created or last updated.

Access by role

The Secrets section is available to org owners, admins, and members. Viewers cannot view or manage secrets, and the section is hidden from them.

Roles are assigned per org member. Learn more about orgs.

Create an org secret

1. Select the org from the project selector.
2. Navigate to the Settings tab and select the Secrets section.
3. Fill the Name and Value fields and click Add.

Secret names must start with a letter or an underscore and may contain only letters, numbers, and underscores, for example GITHUB_TOKEN.

Update or delete a secret

Editing a secret replaces its value. The name cannot be changed. To rename a secret, create a new one and delete the old one.

Deleting a secret requires confirmation, and removes it from every project it is linked to.

Link a secret to a project

1. Select the project.
2. Navigate to the Settings tab and select the Secrets section.
3. Under Linked Organization Secrets, select each secret the project should receive.
4. Click Save linked secrets.

Linked secrets are referenced in the Spicepod configuration exactly like project secrets, as ${secrets:<SECRET_NAME>}:

models:
  - from: openai:gpt-5.6
    name: gpt-5.6
    params:
      openai_api_key: ${secrets:OPENAI_API_KEY}

To apply a change to linked secrets, initiate a new Spicepod deployment. Learn more about deployments.