{"id":10383,"date":"2026-11-11T13:38:50","date_gmt":"2026-11-11T13:38:50","guid":{"rendered":"https:\/\/www.process.st\/help\/?p=10383"},"modified":"2026-11-11T13:38:50","modified_gmt":"2026-11-11T13:38:50","slug":"workflow-secrets-give-your-code-tasks-real-api-keys-safely","status":"publish","type":"post","link":"https:\/\/www.process.st\/help\/workflow-secrets-give-your-code-tasks-real-api-keys-safely\/","title":{"rendered":"Workflow Secrets: Give Your Code Tasks Real API Keys, Safely"},"content":{"rendered":"<p>Code Tasks that call external services like Stripe or Slack need API keys. Until now, the only option was to paste those keys into a Code Task&#8217;s inputs, where they sat in plain text, traveled with every copy of the workflow, and showed up in run logs. Workflow secrets change that: store a key once, use it across every Code Task in the workflow, and keep it encrypted and hidden from the moment you save it.<\/p>\n<h2>What workflow secrets do<\/h2>\n<p>A workflow secret is a named, encrypted value that any Code Task in the workflow can read as <code>secrets.SECRET_NAME<\/code>. Once saved, nobody can view the value again. It&#8217;s encrypted with AWS KMS and can only be replaced or deleted.<\/p>\n<p>Secrets are automatically redacted: if your code logs or returns a secret value as-is, it appears as <code>***<\/code> in the output. No accidental exposure in run logs or form fields.<\/p>\n<h2>How to add a secret<\/h2>\n<ol>\n<li>Open a workflow and click a <strong>Code Task<\/strong>, then open the <strong>Secrets<\/strong> area. Or, click the workflow&#8217;s <strong>&#8230;<\/strong> menu and select <strong>Secrets<\/strong>.<\/li>\n<li>Click <strong>Add secret<\/strong> and enter a name (for example, <code>STRIPE_SECRET_KEY<\/code>) and its value.<\/li>\n<li>Save the secret. From this point on, the value is write-only: you can replace or delete it, but never view it again.<\/li>\n<li>In your Code Task, reference it as <code>secrets.STRIPE_SECRET_KEY<\/code>. The code editor offers autocomplete when you type <code>secrets.<\/code>, so you can pick from your workflow&#8217;s secrets without risking a typo.<\/li>\n<li>Run a <strong>Preview<\/strong> to test end to end. Previews use real secret values for anyone who can edit the workflow.<\/li>\n<\/ol>\n<h2>Built-in safeguards<\/h2>\n<ul>\n<li><strong>Write-only storage:<\/strong> after saving, the value is hidden from everyone, admins included.<\/li>\n<li><strong>Log and field redaction:<\/strong> secrets returned or logged unchanged display as <code>***<\/code>.<\/li>\n<li><strong>Copies start clean:<\/strong> duplicating a workflow, exporting it, or copying it to another organization leaves its secrets behind. No accidental key leaks across workspaces.<\/li>\n<li><strong>Limits:<\/strong> a workflow can hold up to 50 secrets, each up to 4 KB.<\/li>\n<\/ul>\n<h2>Good to know<\/h2>\n<ul>\n<li>Anyone who can edit a workflow&#8217;s code can read its secrets at runtime, similar to GitHub repository secrets. Grant edit access accordingly.<\/li>\n<li>Previews use real values, so previewing a Code Task that creates a Stripe customer creates one. Use test keys while you build.<\/li>\n<\/ul>\n<p>For the full setup guide, see the <a href=\"https:\/\/www.process.st\/help\/docs\/code-task\/\">Code Task<\/a> help article.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Code Tasks that call external services like Stripe or Slack need API keys. Until now, the only option was to paste those keys into a Code Task&#8217;s inputs, where they sat in plain text, traveled with every copy of the workflow, and showed up in run logs. Workflow secrets change that: store a key once, [&hellip;]<\/p>\n","protected":false},"author":22,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"available_plan":"Enterprise","available_product":"Workflows","footnotes":""},"categories":[2],"tags":[],"class_list":["post-10383","post","type-post","status-publish","format-standard","hentry","category-new-feature"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/posts\/10383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/comments?post=10383"}],"version-history":[{"count":1,"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/posts\/10383\/revisions"}],"predecessor-version":[{"id":10409,"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/posts\/10383\/revisions\/10409"}],"wp:attachment":[{"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/media?parent=10383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/categories?post=10383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.process.st\/help\/wp-json\/wp\/v2\/tags?post=10383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}