A Call External API block often needs to send a third-party service's own API key, for example, calling a weather API or a payment provider from inside your endpoint's logic. Pasting that key directly into the block's header value works, but stores it in plain text alongside the rest of your project.
Storing it as a secret instead
From your API project's Keys & Secrets tab, add a secret with a name and value, the value is encrypted before it's stored, and shown once, at save time, never again afterward. Reference it anywhere a Call External API block accepts text, its headers, URL, or body, as {{secret.NAME}}.
Why this is safer than a variable
A secret is resolved and decrypted on our servers before your endpoint's logic runs, strictly before anything a caller sent in their own request is substituted in, so a request can never be crafted to make {{secret.NAME}} resolve to something else or leak its value back out.