Secrets

Secrets store tokens and credentials for MCP servers, plugins, hooks, and other agent integrations without writing values into repositories.

Where secrets are used

MCP configs and plugin-provided MCP servers can reference values with${secrets.name}. AFK resolves those placeholders when a session starts or when an MCP server is configured, then injects the value into the relevant process environment or config path.

{
  "mcpServers": {
    "github-tools": {
      "command": "node",
      "args": ["server.js"],
      "env": {
        "GITHUB_TOKEN": "${secrets.github_token}"
      }
    }
  }
}

User and org secrets

Scope	Who can use it	Who can manage it
User secrets	Your personal sessions.	You.
Org secrets	Sessions running in that org context.	Org admins. Non-admins can see which names exist but not values.

If a user secret and org secret share a name, the user secret takes precedence for that user's sessions. Use distinct names when you need to force org-provided values.

Lifecycle

Open Account → Secrets.
Add or replace a value under User secrets or, as an org admin, Org secrets.
Reference the value as ${secrets.name} in MCP or plugin config.
Restart or reload the session that needs the new secret.

Secret values are not shown in normal lists after storage. Replace a secret when a token rotates. Delete secrets that are no longer needed.

Safety tips

Use the narrowest token scopes available in the external service.
Prefer org secrets for shared team integrations and user secrets for personal accounts.
Do not put raw secret values in .mcp.json, plugin manifests, hooks, prompts, or AGENTS.md.
Use /status to see missing MCP secret names when an MCP server does not start.