> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

```bash theme={null}
telnyx-acp add secret OPENAI_API_KEY
```

```text {2,6,13,14,26,31} theme={null}
support-agent/
├── agent.json                                         ◀
├── instructions.md
└── .telnyx/                        written by deploy
    ├── index.ts
    ├── telnyx.toml                                    ◀
    ├── telnyx-env.d.ts
    └── package.json

@telnyx/acp/                      the package
├── managed/
│   ├── index.ts
│   ├── agent.ts                                       ◀
│   ├── model.ts                                       ◀
│   ├── memory.ts
│   ├── tools.ts
│   ├── mcp.ts
│   ├── voice.ts
│   ├── direct-turn.ts
│   └── filler.ts
├── channels/
│   ├── index.ts
│   ├── phone.ts
│   ├── email.ts
│   ├── web.ts
│   └── wire.ts
├── synth/
│   ├── index.ts                                       ◀
│   ├── code-entry.ts
│   └── vendor.ts
└── spec/
    ├── schema.ts
    ├── model.ts                                       ◀
    ├── phone.ts
    ├── project.ts
    └── io.ts
```

`add secret NAME` prompts for the value, stores it on the platform, and appends the name to `secrets`. At `deploy`, `manifest()` in `synth/index.ts` writes one `[[secrets]]` entry per name into `.telnyx/telnyx.toml`, after the function's identity, the actor and the Telnyx binding:

```toml theme={null}
# Generated by `telnyx-acp deploy` from agent.json. Do not edit; never commit.
name = "support-agent"
main = "index.ts"
compatibility_date = "2026-10-01"

[edge_compute]
func_id = "…"
func_name = "support-agent"

[[actors]]
binding = "SUPPORT_AGENT"
type = "SupportAgent"

[telnyx]
binding = "TELNYX"

[[secrets]]
binding = "OPENAI_API_KEY"
name = "OPENAI_API_KEY"
```

The class reads each secret through `env.SECRETS.get(name)`, on the instance's [`env`](/docs/agent-sdk/interface/env). A third-party model's key is read by `modelKey` in `managed/agent.ts` under the name that `spec/model.ts` maps the provider to, and `managed/model.ts` sends it as `api_key` on each request.

| Provider | Secret |
| - | - |
| `openai/*` | `OPENAI_API_KEY` |
| `anthropic/*` | `ANTHROPIC_API_KEY` |
| `google/*` | `GOOGLE_API_KEY` |
| `groq/*` | `GROQ_API_KEY` |

`modelKey` reads the secret:

```ts theme={null}
// managed/agent.ts
async function modelKey(env, model) {
  const secret = modelKeySecret(model);
  if (!secret || !env.SECRETS) return undefined;
  try {
    return (await env.SECRETS.get(secret)) || undefined;
  } catch {
    return undefined;
  }
}
```

`env.SECRETS` is the secrets binding of the instance's [`env`](/docs/agent-sdk/interface/env), present when `telnyx.toml` declares a secret.

* `secret` is the name that `modelKeySecret` maps the provider to, as in the table.
* A missing binding, a missing secret or a failed read leaves the key out. The inference API then answers with what it needs, and that answer is written to state as `lastError`.