Skip to main content
Environment is where you store the secrets your Operator agents need. Each instance is its own computer, but it cannot access external services without credentials. Secrets supply the credentials it needs: give it a GITHUB_TOKEN and it can work with your repos, give it a DATABASE_URL and it can query your database, give it any API key and it can call that API. You do not need a pre-built integration for every service. Store a credential here, grant it to an instance, and the agent can use it.

​
What gets stored here

CategoryExamples
Source controlGITHUB_TOKEN
EmailRESEND_API_KEY
DatabaseDATABASE_URL
Weather / geoOPENWEATHER_API_KEY
WalletsPRIVY_APP_ID, PRIVY_APP_SECRET
SocialX API secrets, Twilio secrets
InfrastructureCloudflare API token, VERCEL_TOKEN
AI modelsReplicate, fal.ai tokens

​
Access modes

A global secret is automatically available to every instance you own.Use for secrets that every agent should have access to. On Basic, Pro, and Max this is effectively the same as instance specific since each plan only has one agent; on Enterprise it covers every agent in the fleet and any clones Operator spins up.

​
Important behavior

  • Secret values are encrypted at rest (AES-256-GCM).
  • You only see the full value once when you create it.
  • Installing a skill does not create or grant its secrets.
  • The matching secret still needs to exist and be accessible.

​
Common agent requirements

Agent or integrationRequired secrets
GitHubGITHUB_TOKEN
Vercel deploysVERCEL_TOKEN, GITHUB_TOKEN
ResendRESEND_API_KEY
PrivyPRIVY_APP_ID, PRIVY_APP_SECRET
PostgreSQLDATABASE_URL
XX API secrets
TwilioTwilio account secrets
CloudflareCloudflare API token
Managed skills fetch secrets at runtime. Values are never hardcoded. Rotated secrets are picked up on the next use.

Add the secret

Open Environment and create it.

Set the scope

Global for all instances, or instance specific for restricted access.

Grant access

If instance specific, grant it to the right instance.

Ask Operator to use it

Describe what you want. If the matching skill isn’t installed yet, Operator will write one and install it on the instance.
To connect a service that does not have a prebuilt skill, add the credential here and ask Operator to “install a skill that uses to do X.” The agent writes a small skill, deploys it, and the next chat can use it.

Integrations

What secrets connect to

Instances

Where secrets get used

Agents

How agents consume secrets at runtime