diff --git a/appview/pages/pages.go b/appview/pages/pages.go
index eeea3f7d..88c13b65 100644
--- a/appview/pages/pages.go
+++ b/appview/pages/pages.go
@@ -16,6 +16,7 @@ import (
 	"strings"
 	"sync"
 
+	"tangled.sh/tangled.sh/core/api/tangled"
 	"tangled.sh/tangled.sh/core/appview/commitverify"
 	"tangled.sh/tangled.sh/core/appview/config"
 	"tangled.sh/tangled.sh/core/appview/db"
@@ -690,6 +691,8 @@ type RepoSettingsParams struct {
 	Branches       []types.Branch
 	Spindles       []string
 	CurrentSpindle string
+	Secrets        []*tangled.RepoListSecrets_Secret
+
 	// TODO: use repoinfo.roles
 	IsCollaboratorInviteAllowed bool
 }
diff --git a/appview/pages/templates/repo/settings.html b/appview/pages/templates/repo/settings.html
index 76426d7a..8f252b59 100644
--- a/appview/pages/templates/repo/settings.html
+++ b/appview/pages/templates/repo/settings.html
@@ -115,6 +115,50 @@
     </form>
     {{ end }}
 
+    {{ if $.CurrentSpindle }}
+      <header class="font-bold text-sm mb-4 uppercase dark:text-white">
+        Secrets
+      </header>
+
+      <div id="secret-list" class="flex flex-col gap-2 mb-2">
+        {{ range $idx, $secret := .Secrets }}
+         {{ with $secret }}
+           <div id="secret-{{$idx}}" class="mb-2">
+             {{ .Key }} created on {{ .CreatedAt }} by {{ .CreatedBy }}
+           </div>
+         {{ end }}
+        {{ end }}
+      </div>
+      <form
+          hx-put="/{{ $.RepoInfo.FullName }}/settings/secrets"
+          class="mt-6"
+          hx-indicator="#add-secret-spinner">
+          <label for="key">secret key</label>
+          <input
+              type="text"
+              id="key"
+              name="key"
+              required
+              class="dark:bg-gray-700 dark:text-white"
+              placeholder="SECRET_KEY" />
+          <label for="value">secret value</label>
+          <input
+              type="text"
+              id="value"
+              name="value"
+              required
+              class="dark:bg-gray-700 dark:text-white"
+              placeholder="SECRET VALUE" />
+
+        <button class="btn my-2 flex items-center" type="text">
+            <span>add</span>
+            <span id="add-secret-spinner" class="group">
+              {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }}
+            </span>
+        </button>
+      </form>
+    {{ end }}
+
     {{ if .RepoInfo.Roles.RepoDeleteAllowed }}
     <form
         hx-confirm="Are you sure you want to delete this repository?"
diff --git a/appview/repo/repo.go b/appview/repo/repo.go
index 45b59f9c..3cf93b81 100644
--- a/appview/repo/repo.go
+++ b/appview/repo/repo.go
@@ -912,6 +912,78 @@ func (rp *Repo) SetDefaultBranch(w http.ResponseWriter, r *http.Request) {
 	w.Write(fmt.Append(nil, "default branch set to: ", branch))
 }
 
+func (rp *Repo) Secrets(w http.ResponseWriter, r *http.Request) {
+	f, err := rp.repoResolver.Resolve(r)
+	if err != nil {
+		log.Println("failed to get repo and knot", err)
+		return
+	}
+
+	if f.Spindle == "" {
+		log.Println("empty spindle cannot add/rm secret", err)
+		return
+	}
+
+	lxm := tangled.RepoAddSecretNSID
+	if r.Method == http.MethodDelete {
+		lxm = tangled.RepoRemoveSecretNSID
+	}
+
+	spindleClient, err := rp.oauth.ServiceClient(
+		r,
+		oauth.WithService(f.Spindle),
+		oauth.WithLxm(lxm),
+		oauth.WithDev(rp.config.Core.Dev),
+	)
+	if err != nil {
+		log.Println("failed to create spindle client", err)
+		return
+	}
+
+	key := r.FormValue("key")
+	if key == "" {
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodPut:
+		value := r.FormValue("value")
+		if key == "" {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		err = tangled.RepoAddSecret(
+			r.Context(),
+			spindleClient,
+			&tangled.RepoAddSecret_Input{
+				Repo:  f.RepoAt.String(),
+				Key:   key,
+				Value: value,
+			},
+		)
+		if err != nil {
+			log.Println("request didnt run", "err", err)
+			return
+		}
+
+	case http.MethodDelete:
+		err = tangled.RepoRemoveSecret(
+			r.Context(),
+			spindleClient,
+			&tangled.RepoRemoveSecret_Input{
+				Repo: f.RepoAt.String(),
+				Key:  key,
+			},
+		)
+		if err != nil {
+			log.Println("request didnt run", "err", err)
+			return
+		}
+	}
+}
+
 func (rp *Repo) RepoSettings(w http.ResponseWriter, r *http.Request) {
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
@@ -955,6 +1027,22 @@ func (rp *Repo) RepoSettings(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
+		var secrets []*tangled.RepoListSecrets_Secret
+		if f.Spindle != "" {
+			if spindleClient, err := rp.oauth.ServiceClient(
+				r,
+				oauth.WithService(f.Spindle),
+				oauth.WithLxm(tangled.RepoListSecretsNSID),
+				oauth.WithDev(rp.config.Core.Dev),
+			); err != nil {
+				log.Println("failed to create spindle client", err)
+			} else if resp, err := tangled.RepoListSecrets(r.Context(), spindleClient, f.RepoAt.String()); err != nil {
+				log.Println("failed to fetch secrets", err)
+			} else {
+				secrets = resp.Secrets
+			}
+		}
+
 		rp.pages.RepoSettings(w, pages.RepoSettingsParams{
 			LoggedInUser:                user,
 			RepoInfo:                    f.RepoInfo(user),
@@ -963,6 +1051,7 @@ func (rp *Repo) RepoSettings(w http.ResponseWriter, r *http.Request) {
 			Branches:                    result.Branches,
 			Spindles:                    spindles,
 			CurrentSpindle:              f.Spindle,
+			Secrets:                     secrets,
 		})
 	}
 }
diff --git a/appview/repo/router.go b/appview/repo/router.go
index 2ac598cd..16e0af43 100644
--- a/appview/repo/router.go
+++ b/appview/repo/router.go
@@ -74,6 +74,8 @@ func (rp *Repo) Router(mw *middleware.Middleware) http.Handler {
 			r.With(mw.RepoPermissionMiddleware("repo:invite")).Put("/collaborator", rp.AddCollaborator)
 			r.With(mw.RepoPermissionMiddleware("repo:delete")).Delete("/delete", rp.DeleteRepo)
 			r.Put("/branches/default", rp.SetDefaultBranch)
+			r.Put("/secrets", rp.Secrets)
+			r.Delete("/secrets", rp.Secrets)
 		})
 	})