---
title: "How to manage scenario secrets"
description: "Create, rotate, and audit encrypted secrets for Send Request and custom actions in Settings."
---

# How to manage scenario secrets

Central storage for API keys, tokens, and passwords used by **Send Request** and custom actions in scenarios. Secrets are stored encrypted; scenarios keep only a reference to the record.

## When you need this

- You want to save a Bearer/API key/OAuth secret once and reuse it across scenarios.
- You need to rotate a key without editing every Send Request node.
- You want to find inline tokens still stored in constants or node parameters.

## What to know

- **Scenario secrets** — a dedicated tab under **Settings** (route `/settings-page/credentials`, menu label **Scenario secrets**).
- **Availability** — the feature is **off by default**. A root administrator enables it in **Instance settings** (platform feature toggles), then grants role permissions.
- **Permissions:** view (**View** in roles) and save (**Save** in roles) are separate under **Settings → Roles → Scenario secrets**.
- **Not the same as** channel tokens (Telegram/Viber), Mailgun keys, or AI provider keys — those live in other settings areas.
- **Deletion:** a record **in use by a scenario** (including inline references in URL/headers/body) **cannot be deleted** — remove references in nodes first.

## Before you start

- [x] A root administrator enabled **Scenario secrets** for the instance.
- [x] Your role can view or save scenario secrets.
- [x] You are signed in to **Settings** (`/settings-page`).

## Step-by-step

### 1. Open the secrets tab

1. In the main menu, open **Menu → Settings** (or go to `/settings-page`).
2. In the sidebar, select **Scenario secrets**.
3. If the tab is missing, check platform feature toggles (root) and role permissions.

### 2. Create a record

1. Click **Add secret**.
2. Fill in:
   - **Name** — a clear label (e.g. “CRM production API”).
   - **Slug** — unique Latin identifier (e.g. `crm-main`); hard to change after use.
   - **Type** — Bearer, Basic, API key, OAuth2 client credentials, SMTP, Telegram bot, HMAC, etc.
   - **Allowed consumers** — which actions may use the record (for Send Request, pick **Send Request** in the list).
3. Enter secret fields (token, login/password, headers, etc.).
4. Click **Save**. Secret fields clear after save — this is expected.

### 3. Edit metadata

1. Click **Edit** on a row.
2. Change name, description, or allowed consumers.
3. The secret is **not shown** on edit. Use **Rotate secret** to change the secret value.

### 4. Rotate a secret

1. Choose **Rotate secret** for the record.
2. Enter the **new** value.
3. Save. All scenarios referencing this record (inline or legacy) use the new secret without node changes.

### 5. View usage

1. Open **Usage** (or usage details from the table).
2. Review bot, section, node, and action.
3. Before deleting, remove the secret reference from those places in Scenario Builder.

### 6. Legacy secret scan

1. Click **Scan legacy secrets**.
2. Review **Constants**, **Send Request nodes**, and **Custom actions** tabs.
3. Samples are **masked**. Create new records and update references manually — there is no automatic migration.
4. For custom actions, copy migration snippet hints (no decrypted values).

### 7. Delete a record

1. Confirm **Usage = 0**.
2. Click **Delete** and confirm.
3. If still in use, the system blocks deletion — open Usage and remove references.

## Related articles

- [What are scenario secrets](/en/settings/explanation/what-are-action-credentials.md)
- [Use scenario secrets in Send Request](/en/scenariobuilder/how-to/use-saved-credential-in-send-request.md)
- [Use scenario secrets in a custom Action Jail action](/en/actionjail/how-to/use-saved-credential-in-custom-action.md)
- [Configure roles](/en/settings/how-to/configure-roles.md)
- [Configure instance settings](/en/settings/how-to/configure-instance.md)