API keys and tokens are stored as plain fixed values in tool fields and are visible in every tool.

Request: an account- or partner-level secret store, referenced in tools as a variable (for example {{secret.MAPS_KEY}}), masked in the UI, never sent to the model, and rotatable in one place. Please also document who can see fixed parameter and header values today (account users, partner users, the model) and whether they ever reach the model.

Impact: keys can be rotated in one place and one tool definition works in every account.