Managing Credentials

Selu stores credentials — API keys, tokens, and other secrets your agents need — in an encrypted store. You manage them in two places depending on what they’re for.

Agent secrets

Secrets that agents need to call external services (like a weather API key or a search service token) are managed on each agent’s Secrets tab.

1. Go to Agents in the sidebar
2. Click any agent’s name to open its detail page
3. Select the Secrets tab
4. Find the credential you want to set — each one shows a description explaining what it’s for and where to get it
5. Type the value into the field and click Save

Each secret shows whether it’s currently set or missing, and when it was last updated.

Credential scopes

• Shared (system) — One value used by all users. Only admins can set these. Good for organizational API keys.
• Personal (user) — Each person provides their own value. Good for personal accounts or services where everyone has their own login.

Caution

Saved secrets are always masked — you’ll see •••••••• instead of the actual value. To update a secret, just type the new value and save.

Danger

Never share API keys with other users or paste them into chat messages. Use the Secrets tab to store them properly.

Pairing the mobile app

The Settings page also lets you pair the Selu mobile app with your account using a short-lived one-time code.

1. Open Settings from the sidebar.
2. Find the Mobile app card and click Pair a phone.
3. Click Create pairing code.
4. A QR code appears — scan it with your phone’s camera in the Selu app. A one-time code and your Selu address are also shown as text so you can enter them manually if scanning doesn’t work.
5. The code expires after five minutes. If it runs out, click Create another code to generate a fresh one.

Generating a new code automatically cancels any previous pairing attempt that hasn’t been used yet.

Caution

The pairing code is single-use and expires in five minutes. Keep it private — anyone with the code or QR image can pair a device to your account during that window.

Changing your password

From the app

Any logged-in user can change their own password directly in the app:

1. Open the Settings page (accessible from the sidebar or navigation menu)
2. Find the Security section and click Change password
3. Enter your current password
4. Enter and confirm your new password
5. Click Save

After a successful password change, Selu signs out your other active sessions automatically. Your current session stays active so you don’t lose your place.

Tip

Choose a strong, unique password. Selu doesn’t enforce complexity rules but your account security depends on it.

Admin password reset (CLI)

If a user forgets their password and can’t log in, an administrator can reset it using the orchestrator’s command-line tool. This requires access to the server where Selu is running.

echo 'new-password-here' | selu-orchestrator reset-password --username alice --password-stdin

The command:

1. Reads the new password from standard input
2. Hashes it securely with Argon2id
3. Updates the user’s stored password
4. Revokes all of that user’s active web sessions

The user can then sign in with the new password.

Caution

This command requires shell access to the server running Selu. It’s intended as a recovery path, not a routine operation. Store your password somewhere safe.

Danger

Keep your server access credentials secure. Anyone with shell access can reset passwords for any account.

How Selu stores secrets

All secrets — API keys, tokens, passwords — are encrypted using AES-256-GCM before being written to the database. The encryption key is set via the SELU_SECRET_KEY environment variable when you set up Selu.

Danger

If you lose your SELU_SECRET_KEY, all stored credentials become unreadable. Back it up securely. See the environment variables reference for details.