# Secrets

A saved request or a collection variable never holds a credential. Credentials go in Try it's Environment, which stays in the reader's browser. Before every save, update, variable change and import, the server checks the values, whatever the browser already checked, and refuses one that looks like a credential.

## What's refused

| Where | Refused when |
| --- | --- |
| A header or query parameter | Its name is an `apiKey` parameter of a security scheme in your document. |
| A header or query parameter | Its name is `authorization`, `proxy-authorization`, `cookie` or `set-cookie`, or contains `token`, `secret`, `password`, `api-key`, `apikey` or `api_key`, and it has a value. |
| A collection variable | Its name is one of those, and it has a value. |
| Any value: a parameter, the body, the server, a server variable or a collection variable | It has the shape of a known secret, below. |

The shapes:

| Looks like | For example |
| --- | --- |
| A Stripe secret or restricted key | `sk_live_…`, `rk_test_…` |
| A GitHub token | `ghp_…`, `gho_…`, `github_pat_…` |
| A Slack token | `xoxb-…` |
| An AWS access key | `AKIA…` |
| A private key | `-----BEGIN` |
| One of our project or MCP keys | `l10p_…`, `l10m_…` |
| A JSON Web Token | `eyJ….eyJ….` |
| A bearer or basic credential | `Bearer` or `Basic` followed by a token |
| A user or password in a URL | `https://user@…` |

A plain random-looking string passes, because IDs look like that too.

## The answer

A refused save answers `422` with the reason and the field:

```json
{ "error": "X-Api-Key is the API key of the ApiKeyAuth scheme. Credentials are never saved: enter it in Environment, where it stays in your browser.", "field": "header:X-Api-Key" }
```

Every reason ends “Credentials are never saved: enter it in Environment, where it stays in your browser.” The reason names the field and the rule, never the value.

## Where this comes from

- `app/reference/_lib/collections/secrets.ts`
- `app/reference/_lib/collections/respond.ts`
- `app/reference/_lib/collections/store.ts`
- `tests/collections-parity.test.ts`