> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How Secret Manager works

> Learn how Secret Manager stores API keys and credentials, and who can use them

> [!NOTE]
>
> **Available on**: all plans
>
> **Find it in**: Settings in the organization name menu at the top left of the screen > Secret Manager

Secret Manager keeps your API keys, login credentials, and other secrets in one secure place in Profound. Agents, Workflows, Sheets, and AI Marketer (Aim) use a saved secret by its name, so the value never appears in an Agent's or Workflow's settings, a Sheet's cells, or a chat. Learn how to add your first secret in [Create and manage secrets](https://docs.tryprofound.com/platform-config/secret-manager/create-and-manage-secrets.md).

## What problem Secret Manager solves

Automations often need credentials: an API key for your CMS, a token for an internal service, or a login for a tool Aim works with. Without a shared place to keep them, each person pastes the raw value into every Agent, Workflow, Sheet, or chat that needs it. The key ends up copied across many places, anyone who opens the Agent or Workflow can read it, and rotating it means finding and editing every copy.

With Secret Manager, you save the credential once and reference it by name. Your teammates can run the automation with an organization secret without seeing its value, and when the key changes, you update it in one place.

## Use cases

* **Authenticate API calls in Agents and Workflows.** Use a secret as the API key in a [Call API](https://docs.tryprofound.com/agents/workflows/nodes/call-api.md) node or as a secret input of an Agent, so the automation can reach a private API without storing the key in its settings.
* **Use different credentials in each row of a Sheet.** Add a secret column to a [Sheet](https://docs.tryprofound.com/sheets/getting-started.md) and pick a different secret in each row, for example one API key per brand or per client account.
* **Give Aim the credentials it needs.** When Aim needs a credential during a chat, it asks for it in an encrypted form. Save it as a secret to reuse it later, or provide it once without saving it.

## Secret scopes

Every secret has a scope that controls who can use it.

| Scope | Who can use the secret |
| - | - |
| **Organization** | Every member of your organization |
| **Personal** | Only the person who created it |

In Aim, a secret can also be limited to a single chat: when Aim asks for a credential, choose **Provide once** to use it for that chat without saving it to Secret Manager.

## Who can see or change a secret

Only the author of a secret can reveal, edit, or delete it, whatever its scope. Other members can see an organization secret's name, who last updated it, and when, and they can use it in Agents, Workflows, Sheets, and Aim, but the value stays hidden from them.