API secrets

An API secret is another service's API key or token, saved in Settings → API secrets. When Athean calls that service's API for you, Athean's servers add the secret to the request. The secret is sent only to the addresses you allow, and Athean works with the secret's name, never its value.

You can use API secrets from:

• Chat: ask Athean to read from or update another service.
• Agents and automations: their saved instructions or code can call the service on every run. See Agents and Event-triggered automations.
• Custom dashboards: a dashboard can show data it reads from the service. See Custom dashboards.
• Another AI assistant connected through MCP: it can use the secrets you can use, without receiving their values. See Use Athean from another AI assistant.

• No one can see a saved value. After you save a secret, its value is never shown again: not to you, not to organization administrators, and not in Chat. If an API response repeats the value, Athean hides it.
• Never paste a secret into Chat. Don't put an API key in a message, a file, or a link. Save it in Settings → API secrets, then tell Athean which secret to use by name.
• API requests are real and don't ask for approval. Athean makes API calls without an approval card, including requests that create, change, or delete data in the other service. Agree on exactly which requests Athean may make before it calls an API, and before you save an agent or automation that does.
• Public HTTPS services only. Athean calls APIs over HTTPS on the public internet. It can't reach services on a private network.

API secrets let Athean call other services. For the reverse, letting another tool call Athean, an organization administrator creates an organization API key; see API setup.

Anyone in your organization can add an API secret. You become its owner.

1. Open Settings → API secrets and select Add secret.
2. Enter a Secret name, such as reporting_api_key. The name must start with a letter and can have up to 64 letters, numbers, underscores, and hyphens.
3. Paste the key or token into Secret value. The value can be up to 8,192 bytes, and the field hides what you enter.
4. In Allowed destinations, enter the HTTPS addresses the secret may be sent to, such as https://api.example.com. Enter 1 to 10 addresses, separated by commas, without paths or query parameters.
5. Under Who can use this secret, keep Owner only or share it (see Choose who can use a secret).
6. Select Save secret. Athean shows Secret saved. Authorized people can use it without seeing its value.

An allowed destination covers every path on that exact address. A secret allowed for https://api.example.com isn't sent to https://example.com or to any other subdomain. If a service redirects a request to a different address, Athean doesn't send the secret there.

To use the secret, ask Athean in Chat, or in an agent's or automation's conversation, to call the service, and name the secret to use. You don't need to set up a connection first. Athean can read the service's public API documentation, or you can share the documentation with it.

Set access under Who can use this secret when you add or manage a secret:

Sharing grants use only. People who can use a secret can have Athean send it to its allowed destinations, but they can't view its value, rotate it, or change its access. Only the owner and organization administrators can manage a secret, and organization administrators can use and manage every secret in the organization. Group access follows each group's current members.

Athean checks access on every request, as the person the work is for:

Access changes apply to the next request. When someone loses access, requests made for them stop working, including agent runs for them and the API data in dashboards they view.

Settings → API secrets lists every secret you can use or manage, with its Name, Owner, Who can use it, and Allowed destinations. Below each name, Can manage or Can use shows your access. Organization administrators see every secret in the organization.

To change a secret you manage, select its name, or open its row menu and select Manage secret:

• Rotate the value: enter the new key in New secret value (optional). Leave the field blank to keep the current value.
• Rename it or change where it can be sent: edit Secret name or Allowed destinations. You don't need to enter the value again.
• Change who can use it: update Who can use this secret.
• Transfer ownership: choose a person under Owner. The new owner can manage the secret. Afterward, your own access follows the secret's sharing settings unless you're an organization administrator.

Select Save secret to apply your changes. Renaming, rotating, changing access, and transferring ownership keep the secret's reference, so agents, automations, and dashboards that use it don't need to be updated.

Remove a secret

1. Open the secret's row menu and select Remove.
2. Select Remove secret to confirm.

Removal takes effect immediately: agents, automations, and dashboards that use the secret can no longer authenticate with it. Removing a secret can't be undone. Saving the same key again creates a new secret, so ask Athean to update anything that used the old one.