Configuration & secrets

Tools should never contain hard-coded API keys, endpoints, or credentials. Instead they reference project configuration with a {{config.xxx}} template. The real values live in your project settings, encrypted where needed, and are resolved at run time.

Why config references

Secrets stay out of the tool definition. The tool stores {{config.rest-api.my_api.auth_token}}, not the key itself.
One place to update. Rotate a key in project settings and every tool that references it picks up the change.
Governance. The platform knows which tools depend on which configs, and can flag anything missing.

Referencing config

Anywhere a value can be templated — an HTTP header, an auth field, a Python handler — type {{ to open the variable picker. It has two tabs:

Inputs — insert a tool input as {{input.name}}.
Configs — insert a project config as {{config.type.name.key}}. Encrypted fields show a lock icon.

The template variable picker showing the Inputs and Configs tabs

The config selector groups values by category — LLM / AI Models, Databases, Integrations, CRM, and ITSM / Ticketing.

💡

In the HTTP builder, use Map to Project Configs to swap auth fields and headers for config references in one place — the cleanest way to keep secrets out of an HTTP tool.

Auto-detected secrets

When you reference {{config.xxx}} in an implementation, qRaptor detects it and lists it under Auto-detected Secret References: “These config keys were found in your implementation and will be required as project secrets.” The wizard’s Review step repeats this as a Required Configs summary.

The Auto-detected Secret References card listing config keys found in the implementation

Configuration status

Because tools depend on config, each tool has a configuration status shown as a badge in the registry and on the tool:

Badge	Meaning
Ready	Everything the tool needs is present.
Config Required	The tool needs a configuration value that hasn’t been set.
Config Missing	A referenced config can’t be found in project settings.

Hovering the badge shows the specific requirements, what’s missing, and quick links to add the needed values.

Some System tools declare their own requirements — for example, web search needs an integration API key (SerpAPI, Brave, Tavily, or Bing), while pure functions like the calculator need nothing.

Add a missing config

If a tool shows Config Required or Config Missing, add the value in your project’s Configuration section, then return to the tool — its status updates to Ready.

⚠️

Publishing a tool doesn’t create its configs. If a {{config.xxx}} value is missing at run time, the tool fails. Resolve Config Required / Config Missing before agents rely on the tool.

Common issues

Tool stuck on Config Required — the referenced key isn’t set. Open the badge tooltip to see exactly which config to add.
[UNRESOLVED…] in a test — the config path is wrong or the value is missing. Re-insert it from the Configs picker so the path is exact.
Secret visible in the tool — you typed a raw value instead of a reference. Replace it with {{config.xxx}} (or use Map to Project Configs for HTTP tools).