# Org Secrets

**Org secrets** are encrypted key-value pairs defined once for an org and shared with the projects that need them. A shared credential, such as a warehouse password or a model provider API key, is stored in one place instead of being copied into every project that uses it.

An org secret reaches a project only after it is linked to that project. Storing a secret at the org level does not expose it to every project in the org.

Once a secret is saved, its value cannot be read back through Spice Cloud. The portal lists only the secret name and when it was created or last updated.

## Access by role

The **Secrets** section is available to org owners, admins, and members. Viewers cannot view or manage secrets, and the section is hidden from them.

| Role | Org secrets |
| - | - |
| Owner | Create, update, delete |
| Admin | Create, update, delete |
| Member | Create, update, delete |
| Viewer | No access |

Roles are assigned per org member. [Learn more about orgs.](https://spice.ai/docs/cloud/portal/organizations)

## Create an org secret

1. Select the org from the project selector.
2. Navigate to the **Settings** tab and select the **Secrets** section.
3. Fill the **Name** and **Value** fields and click **Add**.

Secret names must start with a letter or an underscore and may contain only letters, numbers, and underscores, for example `GITHUB_TOKEN`.

## Update or delete a secret

Editing a secret replaces its value. The name cannot be changed. To rename a secret, create a new one and delete the old one.

Deleting a secret requires confirmation, and removes it from every project it is linked to.

## Link a secret to a project

1. Select the project.
2. Navigate to the **Settings** tab and select the **Secrets** section.
3. Under **Linked Organization Secrets**, select each secret the project should receive.
4. Click **Save linked secrets**.

Linked secrets are referenced in the Spicepod configuration exactly like project secrets, as `${secrets:<SECRET_NAME>}`:

```yaml
models:
  - from: openai:gpt-5.6
    name: gpt-5.6
    params:
      openai_api_key: ${secrets:OPENAI_API_KEY}
```

> **Note**
>
> When a project secret and a linked org secret have the same name, the project secret takes precedence at runtime.

To apply a change to linked secrets, initiate a new Spicepod deployment. [Learn more about deployments.](https://spice.ai/docs/cloud/portal/app-spicepod/deployments)