SEAOTTER

Ryan Martin

Keep hosted Hermes keys out of chat and .env

Hermes recommends a secret manager at startup, not keys in .env. On SEAOTTER you save once on the write-only Secrets tab. The value is never shown again.

On SEAOTTER, Secrets are write-only integration keys. Paste once on the Secrets tab. We store the value in Google Secret Manager. Hermes loads it at startup. The value is never shown again. Secrets guide.

Pasting an API key into chat puts it in that chat’s history. Dropping it in .env makes the file the vault. Hermes recommends a secret manager at startup. That is how SEAOTTER hosts Hermes.

Secrets, Config, chat

Three surfaces. Three jobs.

SurfaceUse it forLeave it alone for
SecretsIntegration API keysModel names and allowlists
ConfigNon-secret settingsNames that look like API_KEY, TOKEN, or PASSWORD
ChatThe workAnything you would not put in a ticket

Config rejects secret-like keys on purpose. If you hit that block, you are in the wrong tab.

Full steps live in the Secrets guide.

Save once

  1. Open the agent, then Secrets.
  2. Choose Add secret, or Replace on an existing name.
  3. Pick a preset (OPENAI_API_KEY, ANTHROPIC_API_KEY) or type a custom name.
  4. Paste the value once. Save.

The list shows names and status only. Workspace members can see metadata when the role allows it. They cannot add, replace, or delete secrets.

Connect can call upsert_secret and delete_secret. Prefer the dashboard when the value is highly sensitive. Chat history is not a vault.

After save

A running agent restarts so Hermes picks up the new key. The dashboard may be unavailable for a short window, usually under two minutes. Wait for the applying or warming banner to clear.

Then give Hermes a real job that needs the integration. Do not paste the secret into chat as a test.

Rules that hold

One agent, that agent’s keys. Separate clients get separate agents. See one isolated Hermes per client.

Replace. Do not rummage. There is no reveal of the stored value. Rotate by replacing the key.

Connect keys are Connect keys. The so_… access key authenticates SEAOTTER. Use Secrets for model and vendor keys. Connect from chat.

Changelog (2026-08-17)

The write-only Secrets path is how integration keys get onto hosted Hermes. Hermes loads them at startup, the way Hermes recommends. Running agents still restart after save.

See the customer changelog.

← All posts