> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets Quick Reference

> Quick reference guide for creating and using secrets. Fast 3-step guide for API keys and credentials.

# Secrets Quick Reference

Store sensitive credentials securely and inject them into requests without exposing them to clients.

## What is a Secret?

A **secret** is an encrypted credential (like an API key or password) that KnoxCall injects into your backend requests server-side.

**Why use secrets?**

* ✅ Credentials never exposed to clients
* ✅ Centrally managed and encrypted
* ✅ Easy to rotate without code changes

## Real-World Example

**Without secrets (❌ Insecure):**

```javascript theme={"dark"}
// Frontend code - API key exposed!
const stripeKey = "sk_live_abc123";
fetch("https://api.stripe.com/charges", {
  headers: { "Authorization": `Bearer ${stripeKey}` }
});
```

**With secrets (✅ Secure):**

```javascript theme={"dark"}
// Frontend code - Safe!
fetch("https://your-app.knoxcall.com/api/payments", {
  headers: { "Authorization": "Bearer YOUR_KNOXCALL_KEY" }
});
// KnoxCall injects Stripe key server-side
```

## Create a Secret

### Step 1: Navigate to Secrets

1. Click **Resources** in sidebar
2. Select **Secrets**
3. Click **Add Secret**

### Step 2: Fill in Details

**Secret Name:**

```text theme={"dark"}
stripe_api_key
```

*Use lowercase with underscores*

**Secret Value:**

```text theme={"dark"}
sk_live_abc123...
```

*Paste your actual API key*

**Description:** *(optional)*

```text theme={"dark"}
Stripe production API key - rotate every 90 days
```

### Step 3: Save

Click **Save**. The value is encrypted immediately and you'll never see it again!

## Use the Secret in a Route

### Inject as Header

1. Edit your route
2. Scroll to **Header Injection**
3. Add:

```json theme={"dark"}
{
  "Authorization": "Bearer {{secret:stripe_api_key}}"
}
```

*Use `{{secret:secret_name}}` syntax*

### Inject in Body

For POST/PUT requests:

```json theme={"dark"}
{
  "api_key": "{{secret:stripe_api_key}}",
  "other_field": "value"
}
```

## Test It

Make a request through your route:

```bash theme={"dark"}
curl https://your-domain.knoxcall.com/api/payments \
  -H "Authorization: Bearer YOUR_KNOXCALL_KEY"
```

KnoxCall automatically adds:

```text theme={"dark"}
Authorization: Bearer sk_live_abc123...
```

Your Stripe key is injected but never exposed to the client!

## Security Best Practices

✅ **Do:**

* Use descriptive names: `stripe_production_key`
* Rotate every 90 days
* Delete unused secrets
* Use different secrets for dev/staging/prod

❌ **Don't:**

* Use generic names: `secret1`, `key`
* Reuse secrets across services
* Share secrets via email/chat
* Use production secrets in development

## Common Use Cases

**Third-party APIs:**

```text theme={"dark"}
stripe_api_key
sendgrid_api_key
twilio_auth_token
```

**Databases:**

```text theme={"dark"}
database_password
redis_url
postgres_connection_string
```

**OAuth:**

```text theme={"dark"}
google_oauth_token
github_access_token
```

## Next Steps

* Learn about secret rotation for security
* Set up environment-specific secrets
* Configure multiple secrets in one route

**Questions?** Use the support chat!

***

<CardGroup cols={2}>
  <Card title="📊 Statistics" icon="chart-line">
    * **Level**: beginner
    * **Time**: 5 minutes
  </Card>

  <Card title="🏷️ Tags" icon="tags">
    `secrets`, `security`, `credentials`, `quickstart`
  </Card>
</CardGroup>