> ## Documentation Index
> Fetch the complete documentation index at: https://kardow.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Store integration keys in an encrypted vault and reference them by name — values are write-only

The Secrets API is the safe way to give Kardow the third-party API keys your
integrations need — candidate-enrichment providers (PeopleDataLabs, Apollo),
webhook signing keys, or any future integration credential.

## How it works

1. **You store a secret once** with a name (`pdl_api_key`) via this API, the
   dashboard, or the AI connector (MCP).
2. The value is encrypted at rest in the platform vault (Supabase Vault).
   **It can never be read back through any API** — list calls return names and
   dates only.
3. **Feature config references the secret by name** using the `vault:` scheme.
   For example, an enrichment provider's header config:

```json theme={null}
{
  "headers": { "X-Api-Key": "vault:pdl_api_key" }
}
```

At run time the platform backend injects the real value into the outbound
request. The plaintext never appears in your config, in API responses, or in
logs.

## Secret names

Lowercase letters, digits, `_` and `-`, up to 64 characters. Storing a secret
under an existing name replaces its value (handy for key rotation — no config
change needed, since config only holds the name).

## Scopes

| Action                   | Scope           |
| ------------------------ | --------------- |
| List names + dates       | `secrets:read`  |
| Create / update / delete | `secrets:write` |