Skip to main content
Use TrueFoundry’s secret manager to store sensitive values (e.g. API keys) and reference them in AI Gateway integrations instead of pasting raw credentials. This works for Model integrations, MCP servers, and Guardrail integrations.
Secrets are synced from your secret manager to Truefoundry by default every 1 hour - so please make sure that the values remain correct in your secret manager. This allows auto-rotation of secrets to also work since values are fetched every hour.
1

Connect Your Secret Store to TrueFoundry

Integrate your secret store with TrueFoundry (e.g. AWS SSM, GCP Secret Manager, HashiCorp Vault, Azure Vault). This is required for both options below. To connect your Secret store, navigate to Platform > Integrations and add the Integration for your provider. We support AWS SSM, GCP Secrets manager, Azure Vault and Hashicorp.
TrueFoundry does not store the secret values; they live in your secret manager. You get a reference to use in deployments and integrations. See integrate a secret manager for setup.
2

Use the Secret in an Integration

When adding or editing an integration—such as a Model provider (e.g. OpenAI), MCP server, or Guardrail—use one of the two options below in any API key or sensitive field instead of pasting the raw value.Using secret FQN in an integration API key field (example: OpenAI)
Create the secret in a secret group in TrueFoundry, then use its fully-qualified name (FQN) in the integration.Format: tfy-secret://<tenant>:<secret-group>:<secret-key>Example: For tenant my-tenant, secret group openai-keys, and key OPENAI_API_KEY:
tfy-secret://my-tenant:openai-keys:OPENAI_API_KEY
Copy secret FQN from the secret group in TrueFoundryFor full steps on creating secret groups and adding keys, see Secret Management. TrueFoundry resolves the FQN at runtime and injects the value.
Use a secret that already exists in your secret manager. You do not create the secret in TrueFoundry—reference it by your secret store FQN and the path in your store.Format: <secret-store-fqn>::<path-to-secret-in-secret-manager>Example: If your secret store FQN is my-tenant:aws:my-aws-provider:secret-store:aws-ssm and the secret path is /tfy-secret/openai/api-key:
my-tenant:aws:my-aws-provider:secret-store:aws-ssm::/tfy-secret/openai/api-key
You can find the Secret Store FQN on Platform → Integrations, as shown below:Secret Store FQN on Platform Integrations page
You can use the same secret reference formats in YAML/GitOps when defining provider accounts and other integrations, so API keys stay out of version control.