Secrets

Published October 28, 2026 · by the AQ team

Secrets in AQ are API keys, tokens and connection strings stored encrypted and handed to agents, terminals and previews as environment variables. No AQ screen or API ever shows a saved value again. Manage them in Settings, Organization, Secrets.

Personal and organization secrets

Any member can save personal secrets; admins manage the organization's. A secret can be limited to one repository. When the same name exists more than once, the personal secret wins over the organization's, which wins over the repository's uploaded .env file.

Where secrets appear

Terminals, previews, services and every agent run on a work item, chat or bot get the secrets as environment variables. When an agent needs one that is missing, it asks with a secure card in the thread: Save and continue, or Skip. A value saved there reaches the turn that asked without restarting it.

Kept out of the record

Every saved value is replaced with [secret: NAME] in transcripts, run output, commit messages and pull request titles. If you paste something that looks like a key into the composer, AQ offers to save it as a secret instead of sending it.

Imports

Import secrets from a .env file, or from Doppler with the repository's Doppler token, refreshed hourly. Background: keep secrets out of coding agent prompts.