Secrets and Integrations
Add secrets and integration to safely connect Haystack Enterprise Platform to model and service providers.
Overview
Secrets and integrations let you connect Haystack Enterprise Platform to external models or services. These connections allow your pipeline components to use those services without including the API key directly in the component's configuration.
Scope
You can add secrets and integrations at the workspace or organization level
- Workspace-level connections are available only to pipelines and indexes within that specific workspace.
- Organization-level connections are available to all workspaces in the organization.
- Service-level secrets are available only to one service. For details, see Service-Level Secrets.
If the same provider is connected at both the workspace and organization level, the workspace-level connection takes priority and is used in pipelines and indexes.
If you delete a workspace-level connection, but the same provider is connected at the organization level, the organization-level connection is used automatically.
Service-Level Secrets
You can also add a secret to a single service. Only that service can use it, and it doesn't appear in the workspace or organization secrets lists. Use service secrets when one service needs its own credentials, for example a production key that other services in the workspace shouldn't use.
If secrets with the same name exist at more than one level, a service uses the one with the highest priority. From lowest to highest priority:
- Organization secret
- Workspace secret
- Service secret
If you delete a service secret, the service uses the workspace or organization secret with the same name, if one exists.
Service secrets apply to services that run in serverless mode. Managed services don't use them yet. Service secrets are also used when the platform reads a service's tool schema for the MCP server. When you delete a service, its secrets are deleted with it.
To add a service secret, see Add Secrets to a Service.
How Do They Work
Each secret or integration sets an environment variable to store the API key. This way, pipeline components can access the key without you having to add it manually to the configuration. The API key is read from the environment variable.
Integrations
Integrations are most frequently used connections You can find them under Integrations in Workspace and Organization settings.
To connect to a listed provider, just enter your API key and any required details. The platform fills in the integration name for you.
Currently, on the Connections page you can set up connections with the following model providers:
- Amazon Bedrock
- Azure OpenAI
- Cohere
- Google AI
- Hugging Face (only needed for private models hosted there)
- MongoDB
- NVIDIA
- OpenAI
- SearchAPI
- Together AI
- Voyage AI
- Weights & Biases
Supported connections to data processing services and data sources are:
- Azure AI Document Intelligence
- DeepL
- Snowflake
- Unstructured
Secrets
Secrets let you connect to providers not listed on the Integrations page. Use them to:
- Securely manage provider credentials required for custom components to authenticate without hard coding them in pipeline YAMLs.
- Manage different provider credentials for development and production environments.
You can create multiple secrets for one provider, such as one for a development key and another for a production key. This makes it possible to easily swap keys in the pipeline configuration.
Secrets store credentials for third-party providers, such as OpenAI, Cohere, AWS, or Anthropic. If you need a key to call the deepset API itself, see Generate API Keys instead.
For Existing Components
If you're using an existing component (like LangfuseConnector), check its documentation to learn the correct name for the secret. The component reads the API key from a specific environment variable, so the secret name must match that variable name.
For Custom Components
If you're building a custom component, make sure your code uses an environment variable to get the API key. Then, use that variable name as the secret name in the platform.
Was this page helpful?