Secrets are write-only: set a value, reference it from an http action by name — it is never shown again.
Keys let agent hosts read your catalog over MCP. The raw key is shown exactly once; execute additionally lets your http actions run.
execute