Skip to main content

Secrets

Secrets are sensitive values — API keys, signing keys, passwords — stored in the project's encrypted vault. They are referenced by key name in expressions and node configurations, keeping them out of your workflow definitions.

Creating a secret​

Go to Secrets in the sidebar and click New Secret.

FieldRequiredDescription
KeyYesThe reference name used in expressions (e.g. SLACK_SIGNING_SECRET)
ValueYesThe secret value. Write-only — not shown after creation
DescriptionNoA human-readable note about what this secret is
Expires AtNoAn optional expiry date. Blokkio generates notifications before and after expiry

Key names are case-sensitive and must be unique within the project.

Using secrets in expressions​

Reference a secret by its key name using env.get():

{{ env.get('SLACK_SIGNING_SECRET') }}

The value is resolved at execution time and is never logged or exposed in execution details.

Using secrets in node configurations​

Certain node fields accept a secret variable name directly (rather than an expression). For example, the Webhook Trigger's HMAC and API Key verification options have a Secret Variable field — enter the key name without any {{ }} wrapper:

SLACK_SIGNING_SECRET

Expiry notifications​

If you set an expiry date on a secret, Blokkio sends notifications:

  • Expiring Soon — a warning notification before the secret expires
  • Expired — a notification when the secret has passed its expiry date

These appear in the Alerts panel (bell icon in the sidebar). Review and rotate expiring secrets before they affect running workflows.

Security​

  • Secret values are encrypted at rest.
  • Values are never returned by the API after creation.
  • Secrets are resolved server-side at execution time and do not appear in logs.
  • Secrets are project-scoped and not shared between projects.