Code Tasks that call external services like Stripe or Slack need API keys. Until now, the only option was to paste those keys into a Code Task’s inputs, where they sat in plain text, traveled with every copy of the workflow, and showed up in run logs. Workflow secrets change that: store a key once, use it across every Code Task in the workflow, and keep it encrypted and hidden from the moment you save it.

What workflow secrets do

A workflow secret is a named, encrypted value that any Code Task in the workflow can read as secrets.SECRET_NAME. Once saved, nobody can view the value again. It’s encrypted with AWS KMS and can only be replaced or deleted.

Secrets are automatically redacted: if your code logs or returns a secret value as-is, it appears as *** in the output. No accidental exposure in run logs or form fields.

How to add a secret

1. Open a workflow and click a Code Task, then open the Secrets area. Or, click the workflow’s … menu and select Secrets.
2. Click Add secret and enter a name (for example, STRIPE_SECRET_KEY) and its value.
3. Save the secret. From this point on, the value is write-only: you can replace or delete it, but never view it again.
4. In your Code Task, reference it as secrets.STRIPE_SECRET_KEY. The code editor offers autocomplete when you type secrets., so you can pick from your workflow’s secrets without risking a typo.
5. Run a Preview to test end to end. Previews use real secret values for anyone who can edit the workflow.

Built-in safeguards

• Write-only storage: after saving, the value is hidden from everyone, admins included.
• Log and field redaction: secrets returned or logged unchanged display as ***.
• Copies start clean: duplicating a workflow, exporting it, or copying it to another organization leaves its secrets behind. No accidental key leaks across workspaces.
• Limits: a workflow can hold up to 50 secrets, each up to 4 KB.

Good to know

• Anyone who can edit a workflow’s code can read its secrets at runtime, similar to GitHub repository secrets. Grant edit access accordingly.
• Previews use real values, so previewing a Code Task that creates a Stripe customer creates one. Use test keys while you build.

For the full setup guide, see the Code Task help article.