> ## Documentation Index
> Fetch the complete documentation index at: https://docs.polymet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets and outside APIs

> Store an API key safely and call a payment or email service from your app.

A secret is a private value, like an API key, that your app's server-side code needs and the browser must never see. Your backend stores it, and your backend's functions use it to call services like Stripe or Resend.

You need a backend first. See [Add a backend](https://docs.polymet.ai/backend/overview.md).

## Call an outside API

1. Ask for the feature in plain words, and name the service:

   ```text theme={null}
   When someone signs up, send them a welcome email with Resend.
   ```

2. The Polymet Agent writes a function that calls the service, and works out which keys it needs.

3. A form titled **Requesting backend secrets** appears in the chat, with one field per key, such as `RESEND_API_KEY`.

4. Paste each key from the service's dashboard and click **Deploy Secrets**. Click **Skip** to leave them out for now.

5. You see **Deployed backend secrets**. The agent then asks to put the function live: click **Deploy**.

The value goes to your backend. In the chat it shows masked, and it is never written into your project's code.

## Add a secret yourself

1. Open the **Backend** view and click **Secrets**.
2. Under **Add New Secret**, type a **Name** and a **Value**. Click **Add Secret** to add another row.
3. Click **Create Secrets**.

Your keys appear under **Existing secrets** with their names and when they were last updated, never their values. Click **Delete** next to one to remove it.

## Naming and rules

* Use capital letters and underscores, starting with the service's name: `STRIPE_SECRET_KEY`, `RESEND_API_KEY`.
* Do not start a name with `SUPABASE_` or `SB_`. Your backend already uses those for its own keys.
* Secrets are for functions on the server. Never paste a secret key into a prompt asking to use it in a page, because page code runs in the visitor's browser.
* On a branch the agent does not set secrets, because every branch shares the same backend. Switch to the default branch and ask there. See [Manage your data](https://docs.polymet.ai/backend/manage.md).

## Related

* [Manage your data](https://docs.polymet.ai/backend/manage.md) — the Backend view and what the agent asks before it changes things
* [Add a backend](https://docs.polymet.ai/backend/overview.md) — enable the backend for a project
* [Agent connectors](https://docs.polymet.ai/connectors/agent-connectors.md) — tools the agent itself can call while it works, which is different from APIs your app calls


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.