Manage Secrets

Store sensitive values (API keys, tokens) on the backend. Secrets are available only inside Actionflows — not in frontend bindings or client-side code.

Add a secret

Only Owner and Managers can manage secrets.

Open Data → Secrets.
Select Add, then enter Name, Value, and an optional Description. After saving, the value is masked and cannot be revealed again.
Select Sync changes to publish the change.

Use in an Actionflow

For example, to use an API key in an Actionflow:

Add an API node and create the required request header.
Bind the header value from Context → Secret → your secret name.
Run the Actionflow after the secret and Actionflow changes have been published.

Edit and delete

Update or remove secrets in the Secrets panel. Entering a new value replaces the saved value; leaving it unchanged keeps the existing secret. Changes take effect after the next Sync changes.

⚠️

Never expose secret values in client variables, page bindings, or published frontend code.

Secrets in the API request preview

When you preview an API request, bound secrets are filled into the preview in redacted form:

The URL, query parameters, and headers show [redacted: secret <name>] — real values are never returned to the client.
If the project has no secrets configured, the fields stay empty in the preview.
Real values are only substituted server-side when the request is actually sent.