A Call External API block often needs to send a third-party service's own API key, for example, calling a weather API or a payment provider from inside your endpoint's logic. Pasting that key directly into the block's header value works, but stores it in plain text alongside the rest of your project. Call External API requires a Plus or Creator plan, see "Free, Plus, and Creator plans compared", the Keys & Secrets tab itself is available on every plan, you just need Plus or Creator to actually use a stored secret from this specific block.
Storing it as a secret instead
From your API project's Keys & Secrets tab, add a secret with a name and value, the value is encrypted before it's stored, and shown once, at save time, never again afterward. Reference it anywhere a Call External API block accepts text, its headers, URL, or body, as {{secret.NAME}}.
Why this is safer than a variable
A secret is resolved and decrypted on our servers before your endpoint's logic runs, strictly before anything a caller sent in their own request is substituted in, so a request can never be crafted to make {{secret.NAME}} resolve to something else or leak its value back out.