> ## Documentation Index
> Fetch the complete documentation index at: https://microsanbox-staging-appcypher-sdk-runtime-bootstrap.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Go secret substitution and placeholder passthrough

Secrets expose a placeholder to the guest and substitute the real value only for an allowed host and enabled request location. A placeholder in any other location is blocked unless the destination is explicitly allowed to receive it unchanged.

```go theme={null}
headers := false
secret := microsandbox.Secret.Env("GH_TOKEN", token, microsandbox.SecretEnvOptions{
    Allow: []string{"github.com", "api.github.com"},
    Passthrough: []string{"api.anthropic.com"},
    Substitution: microsandbox.SecretSubstitution{
        Headers: &headers,
        Body: true,
    },
    ViolationAction: microsandbox.ViolationActionBlockAndTerminate,
})

sandbox, err := client.CreateSandbox(ctx, "worker",
    microsandbox.WithSecrets(secret),
    microsandbox.WithNetwork(&microsandbox.NetworkConfig{
        SecretViolationAction: microsandbox.ViolationActionBlockAndLog,
    }),
)
```

`Allow` accepts exact hosts and wildcard patterns such as `*.example.com`. Substitution defaults to headers enabled, query disabled, and body disabled. Basic authentication follows the header setting. `Headers` is a pointer so an omitted value keeps the default while `Bool(false)` disables it.

Disabling substitution does not make a placeholder inert: the placeholder is still blocked unless the request host matches `Passthrough`. Passthrough is a host policy, not a violation action.

See [Secrets](/sandboxes/secrets) for CLI and YAML syntax.