# Settings and secrets

Source: https://docs.coderhelm.com/plugins/settings

Declare the values each team fills in for your plugin, and keep secrets away from the model.

> Coming soon: this page describes work that is not on main yet.

<Callout type="info" title="Coming soon">Plugins are being built and switched on team by team; they are not on main yet. This page follows the work in progress and will be updated when plugins ship.</Callout>

Settings are the values that differ between teams: a brand guide, an account to post from. You declare them in the manifest; each team fills them in on the plugin's page. Values live with the team, never in the plugin.

```yaml
settings:
  - key: brand_voice_doc
    type: string
  - key: crm_api_key
    type: secret
  - key: linkedin
    type: connection
    provider: oauth2
    scopes: [w_member_social]
```

## Types [#types]

| Type | What the team does | Notes |
| --- | --- | --- |
| `string` | Types a value. | Agents can read it, unless `sensitive: true`. |
| `secret` | Pastes a value once. | Sealed, never shown again once saved, never given to a model. |
| `connection` | Connects an account. | See [Connections and OAuth](/plugins/connections). Needs `provider`. |

Every field is in the [manifest reference](/plugins/manifest-reference#settings).

## Sensitive values [#sensitive-values]

A `secret`, a `connection`, or any setting with `sensitive: true` is never put in a prompt and never sent back to the dashboard; the page only shows whether it is set ("Set. Enter a new value to replace it."). Like CoderHelm's other keys, these values are encrypted with AWS KMS with the team bound into the encryption, and opened only for the call that needs them.

## Missing values [#missing-values]

A plugin whose settings or connections are not filled in can't do the work that needs them. Name your settings so a person knows what to enter, and explain each one in your plugin's README.