> For the complete documentation index, see [llms.txt](https://help.twinr.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.twinr.dev/twinr-account/account-secrets.md).
# Account Secrets
Create a credential your own backend can use to call the Twinr API, scoped to the apps you choose.
An account secret is a credential your own server uses to call Twinr directly — to send a push notification from your backend, check a build, or update an app without anyone signing in.
It is for code you write and run yourself. If you want an AI assistant to read your account on your behalf, use an [AI connection](/twinr-account/ai-connections.md) instead.
## Create a secret
Go to **My Profile → Account secrets** and click **Create secret**.
Fill in the form:
* **Name** — where you will use it, for example *Vercel prod* or *Order webhook*. Name it after the place it lives, so you know what breaks if you revoke it.
* **Expires** — choose an expiry date, or **Never**. A secret with an expiry stops working on its own, which limits the damage if it is ever leaked.
* **Organization** — the organization the secret belongs to.
* **Apps** — tick the apps this secret may reach. Choose **All apps in this organization** to include apps you create later, or tick individual apps to keep it narrow.
Click **Create**.
{% hint style="warning" %}
**Copy the secret before you close the dialog.** Twinr shows the full secret once, at the moment you create it, and stores only a hashed copy afterwards. Nobody — including Twinr support — can show it to you again. If you lose it, revoke it and create another.
{% endhint %}
## Keep it on your server
Your secret looks like `twnr_live_` followed by a long random string. Treat it like a password:
* Store it in your hosting platform's environment variables, not in your code.
* Never put it in a web page, a mobile app, or anything a visitor can view.
* Never commit it to a Git repository.
Anyone holding the secret can act on the apps you scoped it to, so it belongs only on a server you control.
## Review and revoke
The Account secrets screen lists every secret you have created, with the apps it can reach and when it was last used.
Revoke a secret the moment it is no longer needed, or if you think it may have leaked. Revoking takes effect immediately and cannot be undone — any code still using that secret will stop working, so update your server first.
## Common Questions
I lost my secret. Can I see it again?
No. Twinr stores a hashed copy, not the secret itself, so there is nothing to show you. Revoke the old one and create a replacement.
What happens to a secret when it expires?
It stops working on its expiry date. Requests using it are refused, exactly as if it had been revoked. Create a new secret and update your server before that date.
Should I use one secret for everything?
Use one per place. A separate secret for each server or service means you can revoke one without taking the others down, and the name tells you what is affected.
Is this the same as an AI connection?
No. An account secret is a credential for your own backend. An [AI connection](/twinr-account/ai-connections.md) is approval you give an assistant in your browser, limited to the apps and the permission you choose.
