Read-only. Secrets and API keys are never sent to the browser — configure them in the backend's .env file.