> ## Documentation Index
> Fetch the complete documentation index at: https://docs.capsule.new/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Inject workspace-owned credentials into a Capsule app.

Secrets are workspace-owned values. Use them for model API keys, OAuth client secrets, service tokens, and other credentials that belong to the app operator.

Use [integrations](/features/integrations) when the credential belongs to an app user.

## Create a secret

```bash theme={null}
capsule secret create OPENAI_API_KEY=sk-...
```

List secrets:

```bash theme={null}
capsule secret list
```

## Inject a secret

```python theme={null}
app = cpsl.App(
    name="secret-demo",
    image=cpsl.Image(python_packages=["openai"]),
    secrets=["OPENAI_API_KEY"],
)
```

The secret is available in the app runtime environment.

## Resolve a secret explicitly

```python theme={null}
api_key = cpsl.Secret.from_name("OPENAI_API_KEY").value
```

This checks the local environment first, then falls back to the runtime resolver.

## Use secrets for integration setup

```python theme={null}
app.add_integration(
    cpsl.GitHub(
        client_id=cpsl.Secret.from_name("GITHUB_CLIENT_ID"),
        client_secret=cpsl.Secret.from_name("GITHUB_CLIENT_SECRET"),
        scopes=["repo"],
    )
)
```

The OAuth client belongs to the app operator. The connected GitHub credential belongs to the user.

## Related

* [Connect Services](/build/connect-services)
* [Integrations](/features/integrations)
* [CLI Reference](/reference/cli)