> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usecontextlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Named values, such as API keys, that belong to an Owner and that slates declare by name and mode.

A **secret** is a named value supplied separately from a slate's source code. A declaration records its name and resource mode; the value belongs to an [Owner](https://docs.usecontextlayer.com/core-concepts/owners-and-viewers.md) and is stored separately by ContextLayer.

Declaring a secret and supplying its value are separate steps. For example, an agent can declare `ANTHROPIC_API_KEY`, while the selected Owner supplies the API key without putting it in Git.

## Declare a secret

Declare secrets under `secrets` in the consumer's `slate.json`. Names use uppercase letters, digits, and underscores and cannot start with a digit.

This `digest` agent uses a model selected by the slate's Owner and an API key supplied by the person it acts for:

```json agents/digest/slate.json theme={null}
{
  "connections": {},
  "secrets": {
    "ANTHROPIC_MODEL": { "mode": "owner" },
    "ANTHROPIC_API_KEY": { "mode": "viewer" }
  }
}
```

Hosted agents recognize `ANTHROPIC_MODEL` as model selection and `ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN` as provider authentication. They require a provider credential; model selection is optional. See [Model and authentication](https://docs.usecontextlayer.com/core-concepts/slate/agents.md#model-and-authentication) for defaults and precedence.

Declaring a secret does not create an app environment variable or a general SDK method for reading its value. Hosted-agent model configuration is a supported use of these trusted values.

## Where the value comes from

A declared secret selects the stored value with the same name belonging to the Owner chosen by its mode:

| Mode | Selected value | Who supplies it |
| - | - | - |
| `owner` | The slate Owner's shared secret with that name. | The owning user or a member of the owning organization. |
| `viewer` | The acting person's personal shared secret with that name. | That person. |

In the example, the slate Owner controls the model choice while each acting person supplies their own Anthropic API key. A secret's Owner and its name identify the value, independently of a slate. “Shared secret” means that several slates can select that Owner-and-name value; it does not mean viewers can read the value. Replacing it changes what those slates will use too.

### Supply an owner-mode value

Save the secret with the CLI's `secrets` command, selecting your personal Owner or an organization you belong to. Run `npx @usecontextlayer/cli secrets --help` for its operations and Owner-selection syntax.

The corresponding API operations are [Set a named secret belonging to an Owner](https://docs.usecontextlayer.com/api-reference/shared-secrets/set-a-named-secret-belonging-to-an-owner.md) and [Delete a named secret belonging to an Owner](https://docs.usecontextlayer.com/api-reference/shared-secrets/delete-a-named-secret-belonging-to-an-owner.md).

### Supply a viewer-mode value

Push the declaration to `main`, then open the [chrome](https://docs.usecontextlayer.com/core-concepts/slate#the-chrome) in the private hosted slate. Its configuration tray lists viewer-mode secrets and lets you save a value for each required name. It shows whether a value is saved without displaying the value.

If a required viewer-mode secret is missing, preparation of that consumer's resources reports `secret-required` and names the secret. This can block the consumer even when the requested operation uses an owner-mode resource. The starter's root error boundary shows setup guidance so you can supply the value. Viewer-mode resources are supported on private slates only.

The API operation [Set a declared secret for its selected Owner](https://docs.usecontextlayer.com/api-reference/slate-resources/set-a-declared-secret-for-its-selected-owner.md) uses the slate's declaration to choose the Owner. This slate-aware setup operation also checks whether your whole-slate setup is complete for [membership](https://docs.usecontextlayer.com/core-concepts/owners-and-viewers.md#slate-members).

## Local values

For local resource configuration, supply an environment variable whose name matches the declaration, regardless of its mode. Values stored in ContextLayer do not fill missing local values, and pushing a declaration does not upload local environment values. Restart `pnpm dev` after changing a value so startup reads the new environment.

Local agent execution uses the Claude Agent SDK and your own Claude authentication rather than the hosted model setup. See [Run an agent locally](https://docs.usecontextlayer.com/core-concepts/slate/agents.md#run-an-agent-locally).

## Values stay in trusted execution

Secret-management operations do not return stored values. Saving or deleting a secret returns its Owner and name; setup reads expose only whether a required value is present. ContextLayer loads values inside trusted execution where they are needed. Keep the values out of `slate.json`, source files, and Git.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.