What a secret is for
A secret is an API key, token, or password that a workflow sends to another system, usually in a web request header. When you save it as a secret, it stays out of the workflow itself. The workflow says {{ secrets.CRM_KEY }}, and the real key is only filled in at the moment the request is sent.
That means the key never appears in the workflow editor, in a downloaded copy of the workflow, in a run's history, or anywhere else onscreen.
Save a secret
Click Account, then click Secrets. Only admins can do this.
- In Name, enter a name that uses capital letters, numbers, and
_, and starts with a letter, likeCRM_KEYorSLACK_TOKEN. - In Value, paste the key. It can be up to 4,096 bytes.
- Click Save secret.
Once it's saved, no one can see the value again. To change it, click ⋮ next to the secret, choose Replace, enter the new value, then confirm. The old value can't be recovered.
Use a secret in a workflow
Type {{ secrets.NAME }} wherever the key goes. Most APIs expect the key in a header:
{ "Authorization": "Bearer {{ secrets.CRM_KEY }}" }
Some APIs use their own header name, like {"X-Api-Key": "{{ secrets.SHOP_KEY }}"}. Check the other system's API documentation to see which one it uses.
If a workflow uses a secret that doesn't exist, its web request step fails before sending anything, with the error "No secret called … in this account."
How secrets are protected
Secrets are encrypted with AWS Key Management Service (KMS) as soon as they're saved, and each one is locked to your account and its name, so it can't be opened for any other account. Only Skidle's workflow engine can open them, only for the step that uses them, and AWS logs every time one is opened.
When you delete a secret, it's deleted right away. Any web request step that uses it fails until you save a secret with that name again.