How it works Docs Prices
Login Sign up
Browse documentation

Secrets

Secrets hold credentials and other sensitive values used while a pipeline runs. They share the runtime expression namespace with variables, but their values are not returned after they are saved.

Variables or secrets

Use a variable for non-sensitive configuration that users may inspect, such as a region, build profile, or public endpoint.

Use a secret for passwords, API keys, access tokens, and private credentials. Secret metadata remains visible so a user can confirm that a value is configured without retrieving the value itself.

Create a secret group

  1. Open Secrets in the active workspace.

  2. Select Create group and give the group a recognizable name.

  3. Open the group and add each secret name and value.

  4. Save the group.

Leaving the value of an existing secret blank preserves its current value. Removing its row deletes that secret from the group.

Secret groups are workspace-scoped. A pipeline can attach one secret group and one variable group from its workspace.

Access control distinguishes using a group from managing it. A Secret Group Consumer can supply a group to authorized pipelines without retrieving stored values. A Secret Group Manager can change group metadata and secret entries, but saved secret values still are not returned.

Attach secrets to a pipeline

Open the pipeline page and select the required secret group. The group is resolved when a run starts, producing an immutable execution context for that run.

The same operation is available from codi:

codi pipeline attach-secret-group build-release production-secrets

Reference a secret

Use the secret name in an action parameter:

accessKey: "${BUNNY_STORAGE_PASSWORD}"

A variable and a secret attached to the same pipeline cannot have the same name. Codinamo rejects an ambiguous execution context instead of choosing one value silently.

Log protection

Codinamo replaces exact occurrences of attached secret values with three asterisks before execution logs are persisted. Action outputs and normal variables remain available for diagnostics.

Redaction is a safety boundary, not permission to print credentials. Do not transform, split, encode, or deliberately echo secrets because a derived value may not match the original value that the redactor knows.

See Security guidance and Codi command-line client. See Access catalog for secret-group roles.