# Keep secrets

Encrypted credentials, shared across your store’s works.

Source: https://littleworks.app/docs/secrets

## Add a secret in Shopify

Open **Littleworks → Works → Secrets** (also linked from Agent access), then choose **Add secret**. Enter the name your agent expects, select Preview or Live, and save the value. Names are case-sensitive, start with a letter or underscore, and contain letters, numbers, or underscores, up to 64 characters. Each environment supports 50 secrets; a value is a non-empty string of up to 8 KiB.

Values are encrypted and never shown again in settings. Replace a value to rotate it without redeploying works. Deleting a secret can break works that need it. Refresh if another person changed the secret while you were editing it.

## Read a value inside a work

### Read a credential

```javascript
const apiKey = await secrets.get("EMAIL_API_KEY");
```

Secrets belong to **store + environment** and are available to every work and group in that environment. No manifest declaration is required. `get` returns the string or throws `SECRET_NOT_FOUND`; it never falls back to the other environment. A run keeps the first value it reads for a given name. Replacement and deletion apply to new reads in later runs; an in-progress run may still hold the previous value.

## Guide the merchant without handling the value

`get_context.secrets` lists names, environments, and timestamps, plus a `manageUrl` for this store. Explain which key is needed, where to obtain it, and its minimum required provider permissions. Send the merchant to that URL to enter it. Call `get_context` again to check availability. Never ask them to paste the value into chat, source, a manifest, or a document. There is no management tool that reveals secret values; an agent with code-deployment access can nevertheless write code that reads them.

## Avoid exposing credentials

A value read through `secrets.get` is registered with the SDK and trusted backend redaction filters before it is returned to the work. Exact occurrences are replaced in captured logs and errors, including nested values and free text. This helps prevent accidental leaks; encoding, splitting, or transforming a value can evade matching. Never log a secret, put it in an error, return it to a caller, or save it in a collection. Outputs and stored documents are not automatically redacted.

> **Preview reaches real services**
> Use a service’s sandbox credentials in Preview when available. Separate values do not create an external-service sandbox. Only send credentials to the service they are intended for.

Use the value with [External requests](https://littleworks.app/docs/external-requests). Shopify credentials remain managed by Littleworks; use `shopify.graphql` and the granted Shopify permissions.