Secrets

Secrets store credentials such as API keys, bearer tokens, and webhook signing values for use by an Automation's API Request node. A secret is encrypted at rest and its plaintext value is never shown in the dashboard after you save it.

Enable advanced options to reveal Secrets in your server navigation.

Create a secret

1. Open your server's Secrets page and select Create secret.
2. Give it a recognizable name, such as Production API.
3. Paste the credential value and add a short description for other admins.
4. Enter the exact hostnames that may receive the credential, for example api.example.com.
5. Keep Require HTTPS enabled unless the destination is intentionally unencrypted.
6. Optionally restrict the secret to selected automations. Leave the list empty only when every automation in the server may use it.
7. Save the secret.

Domains are hostnames only. Do not include a protocol, port, path, or wildcard. Enable Allow subdomains only when the credential may safely be sent to all hosts below the allowed domain.

Use the secret in an API Request

Reference the generated environment-style token in the API Request URL, headers, or body:

Authorization: Bearer ${env.production_api}

The name is converted to a lowercase, underscore-separated slug. For example, Production API becomes ${env.production_api}. Assistance replaces this token only when the API Request runs and only after checking the secret's enabled state, domain policy, HTTPS requirement, and allowed-automation list.

The value cannot be wired into messages, templates, or other general text nodes. This prevents an automation from accidentally displaying the credential to a member.

Protect the destination

Anyone who controls an allowed destination—or can read that destination's request logs—may be able to see the credential delivered to it. A person who can run an automation does not receive the secret directly, but can trigger requests where the secret policy allows it.

Keep destinations narrow, grant the minimum automation access, and rotate the credential when you change its policy or a destination's access. Disabling a secret immediately stops it from being injected into new requests. Deleting a secret makes automations that reference it fail until you update them.

API Request limits

API Request accepts http and https destinations. It blocks requests to Assistance and Discord domains, and applies its destination checks again after resolving secret variables. Requests time out after 30 seconds, and redirects are not followed automatically.

Related