Secrets

Secrets are in private beta. Ask for access at support@e2b.dev.

How it holds together#

Write-only — Create and update accept the value; responses, reads, lists and API errors never return it.

Project-scoped — A secret belongs to the project of the API key that created it.

Referenced, not copied — The sandbox configuration carries the secret's name, never its value.

Inject credentials only into destinations you trust. The destination receives the value and could echo it back to the sandbox in its response.

Store a credential under a name you choose

Reference it in a network rule

Running sandboxes pick up the new value

Revoke, and what happens to sandboxes using it

Metadata only, never values

Size, count and pagination limits

Header injection itself uses the same per-host network.rules described in Control internet access.

Per-host rules and transforms

Short-lived tokens instead of long-lived secrets

Updated Sep 23, 2026