# Named secrets

Bot tokens are not the only ciphertext in the vault. **Named secrets** are `namespace/name` values (API keys, translator keys) encrypted the same way. They are **not** stored in project JSON, share codes, or git.

## Where they live

Studio → bot → **Settings → Named secrets**. Namespace + name + password field. Encrypted in `tabbot-vault` (AES-256-GCM). The runner receives a handshake bag at launch and can reveal values without writing them into `project` files.

Official modules that need a key use a `secret()` schema field. Typing into that Modules form writes the vault (`llm/apiKey`, `translation/apiKey`), not the settings object you would export as IR.

## Built-in names

| Key | Who uses it |
| --- | --- |
| `llm/apiKey` | LLM module REST backend, Studio agent FAB, in-guild `/agent` |
| `translation/apiKey` | Translation module (DeepL-compatible) |

QVAC does not need `llm/apiKey`. Switch the LLM backend to QVAC and Studio hides URL, model, and key.

You can store other `namespace/name` pairs for Code-track bots.

## Code studio

```ts
import { vault, log } from '@tabbot/runtime'

export default async function main() {
  const key = await vault.revealSecret('llm', 'apiKey')
  if (!key) log.warn('No llm/apiKey in the vault.')
}
```

`revealSecret` reads the handshake bag. If the vault was locked at launch, the bag is empty until you relaunch with Studio unlocked. Never `log` the value. Never put it in an embed.

Visual HTTP actions must not interpolate `{TOKEN_SECRET}` into logs or public URLs. Prefer Code + `vault.revealSecret` for anything that looks like an authorization header. See [Visual builder reference](/docs/builder/visual-builder).

## Share codes and backups

- **Share codes** — trees and module settings. A `token` field is rejected. Named-secret *values* must not be in the JSON you circulate.
- **Encrypted vault backup** — includes named secrets, still encrypted under your passphrase. That file is a restore, not a pastebin.

## If it leaked

Rotate the third-party key (OpenAI-compatible host, DeepL, …) and the Discord bot token if that went with it. Wipe the named secret in Settings, store the new value, reload the runner. Do not paste the old key into [Community](/docs/guide/community) “so someone can debug it”.

See also [Vault](/docs/guide/vault) and [Why tokens aren’t in URLs](/docs/security/tokens).