Organization secrets
Admin-managed env vars and files shared into every member's cloud sandbox, and who can read them.
Organization secrets are environment variables and files an admin sets once so that every member's cloud work can use them.
| Who | Owners and admins can create, update, and delete. Members cannot write them. |
| Cloud / Local | Cloud only. Local workspaces don't read this store. |
| Plan | No entitlement. |
| Affects | The organization (shared into every member's per-user cloud sandbox). |
Organization secrets are admin-managed. Members cannot retrieve their stored values through the settings API, but members and their agents can consume and read those values after they are materialized into their cloud sandbox.
Creating and updating
From Organization settings, an admin adds env vars and files. Writes (create, replace, delete) are admin-only; a member's request to change an org secret is refused. Any member can see that a secret exists and its name, but not its stored value.
Precedence
Organization secrets are materialized into each member's cloud sandbox alongside their other scopes:
- vs personal. Both land in the sandbox's global environment. On a name collision, the member's personal value takes precedence over the organization value.
- vs repository. Repository secrets are layered into that repo's checkout separately, so they apply on top when an agent works in that repo.
A member's sandbox is materialized with the org secrets from every organization where they hold active membership, not only the one they're working in — so the secrets you store here also land in the sandbox of a member who belongs to other organizations, alongside those organizations' secrets. On a name collision, org values are applied in materialization order (the last one wins) before the member's own personal value wins over all of them. Scope the values you store accordingly.
See Data boundaries for the full scope table.
Storage
Secret values are encrypted at rest. The settings API returns only metadata, the name and size of each env var and file, never the stored value.
Removing a member does not rotate secrets they could read. Any organization secret that was materialized into a departing member's sandbox should be treated as exposed to them and rotated. See Members & roles for removing a member.