> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formae.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Values

> The .opaque and .setOnce modifiers that give a plain value secret-handling or stable-once-generated behavior.

`formae.value()` wraps a regular value so you can attach extra behavior to it. Two modifiers are available: `.opaque` for secrets and `.setOnce` for values that should stay stable across applies.

## Opaque values

`.opaque` marks a value as a secret that is never displayed to the user. Opaque values can still be referenced through `.res` and passed between resources, but they're never shown in logs, output, or CLI results. Use it for passwords, API keys, and other sensitive fields.

```kotlin theme={"languages":{"custom":["/languages/pkl.json"]}}
local dbSecret = new secret.Secret {
  label = "db-password"
  secretString = formae.value("my-secret-password").opaque
}
dbSecret
```

Other resources can still reference the value through `.res`:

```kotlin theme={"languages":{"custom":["/languages/pkl.json"]}}
new dbinstance.DBInstance {
  label = "my-database"
  masterUserPassword = dbSecret.res.secretString  // References the opaque value
}
```

## setOnce

`.setOnce` generates or captures a value the first time it's applied, then keeps it constant on every later apply, even if the expression that produced it would otherwise evaluate to something different. This matters for anything generated randomly: without `.setOnce`, a random password would get a new value on every apply.

```kotlin theme={"languages":{"custom":["/languages/pkl.json"]}}
local dbSecret = new secret.Secret {
  label = "db-password"
  secretString = formae.value(random.id(16).toString()).setOnce
}
dbSecret
```

`random.id(16).toString()` generates a random 16-character identifier; `.setOnce` ensures the same value is reused on every subsequent apply of this forma.

## Combining opaque and setOnce

The two modifiers chain, which is the common case for generated secrets: stable across applies and never shown.

```kotlin theme={"languages":{"custom":["/languages/pkl.json"]}}
apiKey = formae.value(random.id(32).toString()).opaque.setOnce
```

This produces a secret API key that is generated once, never displayed, and never changes.

## See also

* [Resolvable](/documentation/concepts/resolvable): how `.res` references, including opaque values, are consumed by other resources.