Secrets are encrypted credentials stored in your account that Neo agents can access during task execution. Use them to provide API keys, tokens, passwords, and other sensitive values without exposing them in task prompts or project context.
Secrets are accessible from the key icon in the left sidebar or under Settings → Secrets.
Adding a secret
Click + Add Another to add a new secret. Each secret has a name (used as the environment variable key) and a value. The value is masked after saving and never displayed in full again.
Always on
Each secret has an Always on toggle. When enabled, the secret is automatically attached to every task you run without needing to select it manually. When disabled, you can still attach the secret to specific tasks or automations by selecting it at task creation time.
Always on applies to your own tasks only. It does not make the secret available to teammates, including those working in a project you share with them. To share a credential with other members of a project, attach it to that project as described below.
Ownership and sharing
Secrets belong to the account that created them. A teammate who opens Settings → Secrets sees their own secrets, never yours, and a task they start has access only to credentials they own or that have been attached to the project they are working in.
To make one of your credentials usable by other members of a project, attach the secret to that project. Attachment is per secret and per project: attaching WIZ_CLIENT_ID to one project does not attach it to your other projects, and does not attach your other secrets alongside it.
Two consequences worth planning around:
Attach every part of a credential pair. Many integrations need two or more values together, for example a client ID and its matching client secret. Attaching only one of them leaves tasks in that project failing on authentication, with nothing in the secrets list indicating a value is missing. When you attach a credential, attach the whole set.
- A new project starts with no secrets attached. Creating a project, or sharing an existing one with your team, does not carry your credentials into it. Each project needs its own attachments.
If teammates report that Neo is unaware of a secret you have configured, this is almost always the cause: the secret exists on your account but is not attached to the project they are working in.
Using secrets in tasks
When starting a task, click Secrets in the task bar to select which secrets to make available for that run. Any secrets with Always on enabled are pre-selected automatically.
Secrets are available to agents as environment variables using the name you assigned. For example, a secret named GITHUB_TOKEN is accessible as $GITHUB_TOKEN inside the sandbox.
Using secrets in automations
When creating an automation, select secrets from the Secrets field in the Configuration section. The selected secrets are injected into every scheduled run of that automation.
Managing secrets
Rotating a secret: Replace a secret’s value in place from Settings → Secrets. The name stays the same, so every project attachment, automation, and schedule that references it keeps working and uses the new value on its next run. There is nothing to reconfigure.
Neo can also save a new secret for you during a task. If an agent needs a credential you haven’t stored yet, it can store it as a secret without you leaving the chat.
Deleting a secret: Click the trash icon next to it. Deletion is immediate and cannot be undone. Any tasks or automations that relied on that secret will lose access to it on their next run. 
