Secrets & Variables
Store API keys, tokens, and shared configuration once, then reference them safely from any workflow step.
Workflows often need credentials and configuration that shouldn't be pasted into every node - API keys, auth tokens, base URLs, feature flags. Secrets & Variables let you store these once under Settings → Security → Secrets and reference them from any workflow step by key.
Secrets vs variables
Both live in the same list and are referenced the same way, but they protect values differently:
| Secret | Variable | |
|---|---|---|
| Used for | API keys, tokens, passwords | Base URLs, regions, flags, labels |
| Stored as | Encrypted, never as plain text | Plain text |
| Visible in the list | No - shown as •••••• | Yes |
| Referenced as | {{ env.secrets.KEY }} | {{ env.variables.KEY }} |
Secrets are encrypted before they are stored and only decrypted at the moment a workflow step needs them. They are never returned in list queries - the only way to see a secret value again is the explicit Reveal secret button on its edit form.
Rule of thumb
If a value would be a problem in someone else's hands (a key, a token, a password), make it a Secret. If it's harmless configuration anyone on the team may read, a Variable is simpler.
Creating an entry
Open Secrets
Navigate to Settings → Security → Secrets and select Add Secret / Variable.
Pick a key
Give the entry a unique key using letters, digits, and underscores only (for example OPENAI_API_KEY or API_BASE_URL). The key is how workflow steps will reference it, so keep it descriptive and stable.
Choose the type
Leave Secret (encrypted) switched on for credentials. Switch it off for plain-text variables. Add a short description so future you (and your teammates) know what the value is for.
Enter the value and save
Type or paste the value and save. For secrets, this is the last time the value is shown in full - the list will only ever display •••••• afterwards.
Editing and revealing
Opening an entry shows the same form used to create it:
- Secrets open with an empty value field. Saving with the field left blank keeps the existing value; typing a new value replaces it.
- Select Reveal secret to decrypt and load the current value into the field for viewing or copying.
- Variables open with their plain-text value already filled in - just edit and save.
Renaming and deleting
Workflow steps reference entries by key name. Renaming or deleting an entry breaks every step that uses it, so update those steps (and re-publish) in the same change.
Using them in workflow steps
Any node field that supports templating accepts environment references alongside the usual {{ nodes... }} expressions. When a whole field is a single expression, it keeps its native type instead of being flattened into text.
Authorize an HTTP request with a stored API key:
Bearer {{ env.secrets.MY_API_KEY }}A few practical examples:
- HTTP Request headers:
{"Authorization": "Bearer {{ env.secrets.CRM_TOKEN }}"}keeps credentials out of the canvas. - Prompts and queries:
Summarize the ticket using {{ env.variables.SUPPORT_TONE }} tone.lets you tune wording without editing the workflow. - Condition steps:
{{ env.variables.ENVIRONMENT }} == "production"branches behavior per environment.
Values resolve at run time
References are resolved fresh on every run against the current stored values, so rotating a key takes effect immediately - no need to republish workflows that use it.