> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex-labs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage secrets and destinations

> Manage central secret names and versions, then validate restricted publication and alert destinations.

An Admin manages tenant secrets in Console. An Operator manages platform-provided secrets in the operator panel. Only an Admin manages destination definitions.

## Understand secret lookup

A definition declares a secret name, such as `apify-api-token`. It never contains the value. Secrets have no workspace scope in this deployment model.

| Status or source | Meaning |
| - | - |
| Tenant key | A Console value supplies the name. |
| Inherited from Cortex | No tenant value exists; the operator value supplies it. |
| Not set | No usable value is configured. |
| Revoked | The current resolved version cannot be delivered. |
| Overrides Cortex | A tenant value takes precedence over an operator value. |

Lookup checks the Console value first. A revoked tenant version stops lookup; it does not fall back. An Admin must delete that tenant secret to return to the operator value.

## Create, rotate or revoke securely

1. Open the secrets page for the level you manage.
2. Inspect the exact name and its listed consumers.
3. Enter or rotate the value through the secure form.
4. Inspect the saved status without copying the value into chat or ordinary configuration.
5. Test an authorised consumer and inspect its recorded secret version and outcome.

Nobody can read a stored value, including its manager. A platform-generated value is shown once at creation. Capture it only in the intended secure destination.

Rotation affects new admission. An in-flight or recovered ingestion run keeps its recorded secret version. Revoking that version stops future delivery of it, including to a running attempt.

Deletion can be blocked while a recorded run is active or during its late-usage reconciliation period. Resolve the consumer state before retrying deletion.

Every signed-in user can inspect secret names and status. That does not disclose values or grant Console management. Private consumer titles remain hidden.

## Configure a destination

In **Forge → Destinations**, create or edit the permitted HTTPS webhook or TAK destination. Declare its secret names and security label limit.

Inspect the address, intended recipients and data permitted to leave. Publish the definition only after the required secrets are usable.

Send a test and inspect each delivery outcome. A destination's successful test does not prove that every future classified payload is permitted.

Watch owners can select the destination by name, kind and label limit. They do not receive its private connection settings.

## Handle updates and failures

Alert delivery uses the newest published destination version. Revoking that newest version stops the destination without falling back to an earlier version.

Inspect connection errors, refused addresses, invalid secrets and destination responses separately. Failed delivery to one destination does not stop every other destination.

Tenant-supplied provider keys are paid directly by the tenant. Platform-provided keys follow the platform's usage pricing. Verify the actual billing arrangement in [Set budgets and billing ownership](/administration/configuration-and-usage/budgets-billing-ownership).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.