Managing Secrets and Credentials

The Secret Manager gives you a central, secure place to store API keys, passwords, tokens, and other sensitive credentials that your agents depend on. Instead of hardcoding sensitive values directly into agent steps, you define them once in the Secret Manager and reference them by name wherever they are needed. Secrets are encrypted at rest and resolved securely at runtime, so the plaintext value is never exposed in your agent configuration.

How it works

When you save a secret, Harmony encrypts and stores the value separately from your agent definitions. When an agent runs, the runtime resolves the secret reference and injects the value at that moment - the plaintext never appears in your agent configuration, logs, or exports.

You reference a secret inside an agent step using its name. If you later rotate the underlying value, every agent that references that secret automatically picks up the new value the next time it runs, with no edits required to the agents themselves.

Accessing the Secret Manager

1. Open Settings from the main navigation.
2. Select Secret Manager from the Settings menu.

The Secret Manager is accessible across all Harmony modules, so the same credentials can be shared between agents without duplication.

Adding a secret

1. In the Secret Manager, click Add Secret.
2. Enter a unique Name for the secret. This is the identifier you will reference inside your agents, so choose a clear, descriptive name (for example, payment_api_key or crm_bearer_token).
3. Enter the Value - the actual credential or sensitive string you want to store.
4. Click Save.

The value is encrypted immediately on save. After saving, the plaintext value is no longer displayed in the interface.

Rotating a secret

Rotating a secret updates its stored value without changing its name. Because agents reference secrets by name, they automatically use the new value on their next run.

1. Find the secret you want to rotate in the Secret Manager list.
2. Click Edit next to that secret.
3. Enter the new value.
4. Click Save.

All agents that reference this secret will now resolve to the updated value at runtime.

Deleting a secret

Before deleting a secret, check its usage count to understand which agents depend on it. Deleting a secret that is still referenced by active agents will cause those agents to fail at runtime.

1. Find the secret in the Secret Manager list.
2. Review the Used in count to see how many agents currently reference it.
3. Click Delete and confirm the action.

Tracking secret usage

Each secret in the Secret Manager displays a usage count showing how many agents are currently referencing it. Use this information to:

• Identify unused secrets that can be safely removed.
• Understand the blast radius before rotating or deleting a credential.
• Audit which agents depend on a particular third-party service.

Using secrets in Agent Builder

Secrets are available inside the HTTP Request block in Agent Builder. Instead of entering a raw credential value into a header or parameter field, you select the secret by name from the available references.

1. Open an agent in Agent Builder and add or edit an HTTP Request block.
2. In the field where you would normally enter a sensitive value (for example, an Authorization header value or an API key parameter), use the secret reference format to point to your stored secret.
3. Save the agent.

At runtime, Harmony resolves the reference and sends the actual credential value - without ever writing it into the agent definition itself.

Security considerations

• Encryption at rest - All secret values are encrypted before being stored.
• Runtime resolution - Plaintext values are only resolved at the moment an agent step executes, and are never persisted in agent configuration or run logs.
• Least-privilege access - Only users with appropriate Settings permissions can create, edit, or delete secrets.
• Rotation without downtime - Because agents reference secrets by name, you can rotate credentials without editing or redeploying any agent.

---

Where to find in the UI

1. Open Settings in the sidebar, at /settings.
2. Select Secret Manager, at /settings/secret-manager.

Secrets stored here can be referenced by agents without exposing their values, and they are never shown in run history or step outputs.