feat(secrets): carry visible secret values on the v2 list and document visibility

Author: icecrasher321

apps/docs/content/docs/en/platform/credentials.mdx

@@ -119,12 +119,27 @@ Click **Details** on any secret row to open its detail view.
 From here you can:
 
 - View the **Key** and edit the **Value**
+- Toggle **Visibility** — show the value unmasked in run output; see [Visibility](#visibility)
 - Edit the **Description** — an optional note telling teammates what the secret is for. Workspace secrets only; a personal secret is not shared, so it has none
 - Manage **Members** — invite teammates by email and assign them an **Admin** or **Member** role
 - Open **See usage** — where this secret has actually been used
 
 Click **Save** to apply changes, or **Back** to return to the list.
 
+### Visibility
+
+By default, a secret's resolved value is masked everywhere Sim shows run output (see [Execution log protection](#execution-log-protection)). For values that aren't actually sensitive — a staging key, a shared base URL — that masking makes your own logs harder to read.
+
+**Show value in logs and Chat** turns masking off for one workspace secret. With it on:
+
+- Run logs, Chat, and code output show the real value instead of `{{KEY}}`
+- Files a run writes with the value in them stay readable and attachable
+- The Secrets API list includes the value for this secret, so external agents can read it directly instead of scraping logs
+
+The value becomes visible to **anyone who can see this workspace's runs** — including publicly shared log links and log exports, and regardless of member restrictions on the secret itself. Only turn it on for values you'd be comfortable printing in a log.
+
+The switch applies to future runs only. Logs written while the secret was masked stay masked, and anything written while it was visible keeps the value even if you turn masking back on. If another secret holds the same value, that value stays masked — masking always wins a conflict. Workspace secrets only; the same people who can edit the description can flip it.
+
 ### See usage
 
 **See usage** lists the runs that resolved this secret: when it was last used, what used it (a workflow, the Sim agent, or an MCP server), how it was triggered, who it resolved under, and a link to the most recent run in Logs. Rows are grouped by day, so a workflow on a schedule reads as one row per day rather than thousands.

apps/docs/openapi-v2-resources.json

@@ -2447,7 +2447,7 @@
       "get": {
         "operationId": "listSecrets",
         "summary": "List Secrets",
-        "description": "List workspace and caller-owned personal secret metadata with opaque cursor pagination. Only names, scope, role, and timestamps are returned; secret values are never returned. A workspace API key is rejected with `403`; use a personal API key.",
+        "description": "List workspace and caller-owned personal secret metadata with opaque cursor pagination. Rows for workspace secrets marked visible (unredacted) include the stored value; every other row is metadata-only and no other response ever carries a value. A workspace API key is rejected with `403`; use a personal API key.",
         "tags": ["Secrets"],
         "parameters": [
           {
@@ -5581,7 +5581,7 @@
           }
         ]
       },
-      "V2Secret": {
+      "V2SecretWithValue": {
         "type": "object",
         "properties": {
           "name": {
@@ -5627,6 +5627,10 @@
             "format": "date-time",
             "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
             "description": "ISO 8601 timestamp when the secret was last updated."
+          },
+          "value": {
+            "description": "The stored secret value. Present only when the workspace secret is marked visible (unredacted); omitted for every other secret.",
+            "type": "string"
           }
         },
         "required": [
@@ -5639,16 +5643,16 @@
           "updatedAt"
         ],
         "additionalProperties": false,
-        "title": "Secret metadata",
-        "description": "Public secret metadata without the stored secret value."
+        "title": "Secret metadata with visible value",
+        "description": "Secret metadata; the stored value is included only for a workspace secret marked visible (unredacted)."
       },
       "ListSecretsResponse": {
         "type": "object",
         "properties": {
           "data": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/V2Secret"
+              "$ref": "#/components/schemas/V2SecretWithValue"
             },
             "description": "Items in the current page."
           },
@@ -5667,7 +5671,7 @@
         "required": ["data", "nextCursor"],
         "additionalProperties": false,
         "title": "List secrets response",
-        "description": "Secret metadata visible to the caller without stored values.",
+        "description": "Secret metadata visible to the caller; visible (unredacted) workspace secrets carry their value.",
         "examples": [
           {
             "data": [
@@ -5679,12 +5683,83 @@
                 "role": "admin",
                 "createdAt": "2026-06-01T09:14:00.000Z",
                 "updatedAt": "2026-06-20T14:02:11.000Z"
+              },
+              {
+                "name": "STAGING_BASE_URL",
+                "scope": "workspace",
+                "description": "Staging environment base URL.",
+                "unredacted": true,
+                "role": "member",
+                "createdAt": "2026-06-03T11:30:00.000Z",
+                "updatedAt": "2026-06-21T08:45:09.000Z",
+                "value": "https://staging.example.com"
               }
             ],
             "nextCursor": null
           }
         ]
       },
+      "V2Secret": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[A-Za-z0-9_]+$",
+            "description": "Secret name containing only letters, numbers, and underscores."
+          },
+          "scope": {
+            "type": "string",
+            "enum": ["workspace", "personal"],
+            "description": "Whether the secret belongs to the workspace or to the caller. A personal secret belongs to the caller across every workspace, not to one workspace."
+          },
+          "description": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "What the secret is for, as set on the workspace secret. Always null for a personal secret, which has no shared audience."
+          },
+          "unredacted": {
+            "type": "boolean",
+            "description": "Whether the workspace secret opts out of redaction, so its value appears in plaintext in run logs and model-visible content. Always false for a personal secret."
+          },
+          "role": {
+            "type": "string",
+            "enum": ["admin", "member"],
+            "description": "Caller role for the secret."
+          },
+          "createdAt": {
+            "type": "string",
+            "format": "date-time",
+            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+            "description": "ISO 8601 timestamp when the secret was created."
+          },
+          "updatedAt": {
+            "type": "string",
+            "format": "date-time",
+            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+            "description": "ISO 8601 timestamp when the secret was last updated."
+          }
+        },
+        "required": [
+          "name",
+          "scope",
+          "description",
+          "unredacted",
+          "role",
+          "createdAt",
+          "updatedAt"
+        ],
+        "additionalProperties": false,
+        "title": "Secret metadata",
+        "description": "Public secret metadata without the stored secret value."
+      },
       "SetSecretResponse": {
         "type": "object",
         "properties": {

apps/sim/app/api/v2/secrets/[name]/route.test.ts

@@ -83,6 +83,7 @@ const secret = {
   updatedAt: new Date('2026-01-02T00:00:00Z'),
   hasServiceAccountKey: false,
   role: 'admin' as const,
+  unredacted: false,
 }
 const context = { params: Promise.resolve({ name: SECRET_NAME }) }
 

apps/sim/app/api/v2/secrets/route.test.ts

@@ -81,6 +81,7 @@ const secret = {
   updatedAt: new Date('2026-01-02T00:00:00Z'),
   hasServiceAccountKey: false,
   role: 'admin' as const,
+  unredacted: false,
 }
 
 describe('GET /api/v2/secrets', () => {
@@ -92,6 +93,7 @@ describe('GET /api/v2/secrets', () => {
     mocks.gate.mockResolvedValue(null)
     mocks.list.mockResolvedValue({
       secrets: [secret],
+      values: {},
       userId: 'user-1',
       nextCursorKeys: null,
       sortBy: 'name',
@@ -114,14 +116,15 @@ describe('GET /api/v2/secrets', () => {
           name: 'STRIPE_API_KEY',
           scope: 'workspace',
           description: null,
+          unredacted: false,
           role: 'admin',
           createdAt: '2026-01-01T00:00:00.000Z',
           updatedAt: '2026-01-02T00:00:00.000Z',
         },
       ],
       nextCursor: null,
     })
-    expect(JSON.stringify(body)).not.toContain('value')
+    expect(JSON.stringify(body)).not.toContain('"value"')
     expect(mocks.list).toHaveBeenCalledWith({
       principal: PRINCIPAL,
       input: {
@@ -138,6 +141,41 @@ describe('GET /api/v2/secrets', () => {
     })
   })
 
+  it('carries the stored value for exactly the rows marked visible', async () => {
+    mocks.list.mockResolvedValue({
+      secrets: [
+        secret,
+        {
+          ...secret,
+          id: 'secret-3',
+          displayName: 'STAGING_BASE_URL',
+          envKey: 'STAGING_BASE_URL',
+          unredacted: true,
+        },
+      ],
+      values: { STAGING_BASE_URL: 'https://staging.example.com' },
+      userId: 'user-1',
+      nextCursorKeys: null,
+      sortBy: 'name',
+      sortOrder: 'asc',
+    })
+
+    const response = await GET(
+      new NextRequest(`http://localhost:3000/api/v2/secrets?workspaceId=${WORKSPACE_ID}`, {
+        headers: { 'x-api-key': 'key' },
+      })
+    )
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(body.data[0]).not.toHaveProperty('value')
+    expect(body.data[1]).toMatchObject({
+      name: 'STAGING_BASE_URL',
+      unredacted: true,
+      value: 'https://staging.example.com',
+    })
+  })
+
   /**
    * Pins the binding end-to-end — the mint in `present` and the read in
    * `mapInput` — because the contract-level sweep only checks a hand-maintained
@@ -157,6 +195,7 @@ describe('GET /api/v2/secrets', () => {
           description: 'leaked from a workspace mirror',
         },
       ],
+      values: {},
       userId: 'user-1',
       nextCursorKeys: null,
       sortBy: 'name',
@@ -178,6 +217,7 @@ describe('GET /api/v2/secrets', () => {
   it('refuses a cursor minted under a different filter', async () => {
     mocks.list.mockResolvedValue({
       secrets: [secret],
+      values: {},
       userId: 'user-1',
       nextCursorKeys: ['STRIPE_API_KEY', 'secret-1'],
       sortBy: 'name',
@@ -209,6 +249,7 @@ describe('GET /api/v2/secrets', () => {
   it('resumes a cursor replayed under the filters it was minted with', async () => {
     mocks.list.mockResolvedValue({
       secrets: [secret],
+      values: {},
       userId: 'user-1',
       nextCursorKeys: ['STRIPE_API_KEY', 'secret-1'],
       sortBy: 'name',

apps/sim/app/api/v2/secrets/route.ts

@@ -23,7 +23,7 @@ function secretCursorFilters(query: { workspaceId: string; scope?: string; searc
   })
 }
 
-/** GET /api/v2/secrets — List secret names and metadata without reading their values. */
+/** GET /api/v2/secrets — List secret metadata; visible (unredacted) secrets carry their value. */
 export const GET = defineV2JsonRoute({
   contract: v2ListSecretsContract,
   operation: secretOperations.list,
@@ -40,8 +40,10 @@ export const GET = defineV2JsonRoute({
     ),
   }),
   useCase: listSecretsUseCase,
-  present: ({ secrets, userId, nextCursorKeys }, { query }) => ({
-    data: secrets.map((secret) => toV2Secret(secret, userId)),
+  present: ({ secrets, values, userId, nextCursorKeys }, { query }) => ({
+    data: secrets.map((secret) =>
+      toV2Secret(secret, userId, secret.envKey ? values[secret.envKey] : undefined)
+    ),
     nextCursor: writeSortedCursor(
       nextCursorKeys,
       query.sortBy,

apps/sim/app/api/v2/secrets/utils.ts

@@ -1,22 +1,33 @@
-import type { V2Secret } from '@/lib/api/contracts/v2/secrets'
+import type { V2SecretWithValue } from '@/lib/api/contracts/v2/secrets'
 import type { VisibleWorkspaceCredential } from '@/lib/credentials/queries'
 
-/** Serialize environment credential metadata as a secret without exposing its stored value. */
-export function toV2Secret(row: VisibleWorkspaceCredential, userId: string): V2Secret {
+/**
+ * Serialize environment credential metadata as a secret. The stored value is
+ * attached only when supplied AND the row is a workspace secret marked visible
+ * (unredacted) — the guard here, not only at the caller, so no code path can
+ * hand a value to a row whose flag does not disclose it.
+ */
+export function toV2Secret(
+  row: VisibleWorkspaceCredential,
+  userId: string,
+  value?: string
+): V2SecretWithValue {
   if (!row.envKey || (row.type !== 'env_workspace' && row.type !== 'env_personal')) {
     throw new Error(`Credential ${row.id} is not a secret`)
   }
   if (row.type === 'env_personal' && row.envOwnerUserId !== userId) {
     throw new Error(`Personal secret ${row.id} is not owned by the caller`)
   }
 
+  const unredacted = row.type === 'env_workspace' ? row.unredacted : false
   return {
     name: row.envKey,
     scope: row.type === 'env_workspace' ? 'workspace' : 'personal',
     description: row.type === 'env_workspace' ? row.description : null,
-    unredacted: row.type === 'env_workspace' ? row.unredacted : false,
+    unredacted,
     role: row.role,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
+    ...(value !== undefined && unredacted ? { value } : {}),
   }
 }

apps/sim/app/workspace/[workspaceId]/settings/secrets/[credentialId]/secret-detail.tsx

@@ -261,7 +261,7 @@ export function SecretDetail({ workspaceId, credentialId }: SecretDetailProps) {
                 <Label htmlFor='secret-unredacted'>Show value in logs and Chat</Label>
                 <p className='text-[var(--text-muted)] text-caption'>
                   {
-                    'The value is visible to anyone who can see this workspace’s runs, including shared log links.'
+                    'The value is visible to anyone who can see this workspace’s runs — in logs, Chat, and the API, including shared log links.'
                   }
                 </p>
               </div>

apps/sim/lib/api/contracts/v2/openapi/resources.ts

@@ -250,6 +250,17 @@ const SECRET_EXAMPLE = {
   updatedAt: '2026-06-20T14:02:11.000Z',
 } as const
 
+const VISIBLE_SECRET_EXAMPLE = {
+  name: 'STAGING_BASE_URL',
+  scope: 'workspace',
+  description: 'Staging environment base URL.',
+  unredacted: true,
+  role: 'member',
+  createdAt: '2026-06-03T11:30:00.000Z',
+  updatedAt: '2026-06-21T08:45:09.000Z',
+  value: 'https://staging.example.com',
+} as const
+
 type ResourceTag =
   | 'Workspaces'
   | 'MCP Servers'
@@ -1140,7 +1151,7 @@ const declaredRoutes = [
     resourceOperation('Secrets', {
       operationId: 'listSecrets',
       summary: 'List Secrets',
-      description: `List workspace and caller-owned personal secret metadata with opaque cursor pagination. Only names, scope, role, and timestamps are returned; secret values are never returned. ${WORKSPACE_API_KEY_DENIED}`,
+      description: `List workspace and caller-owned personal secret metadata with opaque cursor pagination. Rows for workspace secrets marked visible (unredacted) include the stored value; every other row is metadata-only and no other response ever carries a value. ${WORKSPACE_API_KEY_DENIED}`,
       errors: RESOURCE_ERRORS,
       success: { description: 'Secret metadata visible to the caller.' },
     }),
@@ -1155,8 +1166,8 @@ const declaredRoutes = [
         v2ListSecretsContract.response.schema,
         'ListSecretsResponse',
         'List secrets response',
-        'Secret metadata visible to the caller without stored values.',
-        [{ data: [SECRET_EXAMPLE], nextCursor: null }]
+        'Secret metadata visible to the caller; visible (unredacted) workspace secrets carry their value.',
+        [{ data: [SECRET_EXAMPLE, VISIBLE_SECRET_EXAMPLE], nextCursor: null }]
       ),
     }
   ),