# Secrets

Encrypted upstream credentials for bearer tokens, basic auth, and API keys used by auth profiles.

Secret plaintext is write-only. Crank encrypts secret values with the workspace master key. After create or rotate, the API returns only metadata, so this page focuses on lifecycle and usage references.
Workspace secrets

Name | Kind | Version | Last used | Used by | Status |
--- | --- | --- | --- | --- | --- | ---

Auth profile references
Profiles resolve secrets at runtime before upstream execution.
Create secret
Secret name
Use a stable operator-facing label. Plaintext values are never returned after storage.
Secret kind
Secret value
Username
Password
JSON payload
Useful for generic secret payloads. The value must be valid JSON.
Creation stores encrypted plaintext and returns metadata only.