# Secrets

> How AQ secrets work: personal and organization secrets as environment variables, request cards, scrubbing from transcripts and commits, and imports.

Published October 28, 2026 · by the AQ team · Canonical: https://aq.dev/docs/secrets/

Secrets in AQ are API keys, tokens and connection strings stored encrypted and handed to agents, terminals and previews as environment variables. No AQ screen or API ever shows a saved value again. Manage them in Settings, Organization, Secrets.

## Personal and organization secrets

Any member can save personal secrets; admins manage the organization's. A secret can be limited to one repository. When the same name exists more than once, the personal secret wins over the organization's, which wins over the repository's uploaded .env file.

## Where secrets appear

Terminals, previews, services and every agent run on a work item, chat or bot get the secrets as environment variables. When an agent needs one that is missing, it asks with a secure card in the thread: Save and continue, or Skip. A value saved there reaches the turn that asked without restarting it.

## Kept out of the record

Every saved value is replaced with `[secret: NAME]` in transcripts, run output, commit messages and pull request titles. If you paste something that looks like a key into the composer, AQ offers to save it as a secret instead of sending it.

## Imports

Import secrets from a .env file, or from Doppler with the repository's Doppler token, refreshed hourly. Background: [keep secrets out of coding agent prompts](https://aq.dev/guides/keep-secrets-out-of-coding-agent-prompts/).

---

About AQ: AQ is the multiplayer coding harness where teams chat, build and run bots with every AI coding agent, like Claude Code and Codex: shared live terminals, review and merge, app previews and standing jobs, in your own cloud. Start at [aq.dev](https://aq.dev/).