get_secret

get_secret(name: str, default=None) -> str

Reads a credential you stored under Settings → Secrets. Store it once and reference it by name from every action that needs it, instead of pasting the key into each one.

Parameters

Name	Type	Description
`name`	`str`	The secret's name, e.g. `MONDAY_API_KEY`
`default`	`any`	Returned if the secret does not exist. If omitted, `SecretNotFound` is raised.

Behavior

Only the secrets you actually ask for are transmitted.
Repeated calls within one execution are served from memory; the cache is cleared between executions, so a rotated secret takes effect on the next run.
Values are stripped from stdout, stderr and your return value before Octocom stores or displays them.

Examples

Call a third-party API

def execute_action(context):
    key = get_secret("MONDAY_API_KEY")

    response = requests.post(
        "https://api.monday.com/v2",
        headers={"Authorization": key},
        json={"query": "{ boards(limit: 1) { id name } }"},
        timeout=30,
    )
    response.raise_for_status()
    return response.json()

Fall back when a secret is optional

def execute_action(context):
    webhook = get_secret("OPS_SLACK_WEBHOOK", default=None)
    if not webhook:
        return {"skipped": "no webhook configured"}

    requests.post(webhook, json={"text": "Order escalated"}, timeout=30)
    return {"notified": True}

Handle a missing secret explicitly

def execute_action(context):
    try:
        key = get_secret("JIRA_TOKEN")
    except SecretNotFound:
        return {"error": "Add JIRA_TOKEN under Settings > Secrets first"}

    # ... use key ...

Never return or print a secret

Octocom scrubs known secret values out of your output, but that safety net only recognises the value exactly as stored. A value you have sliced, encoded or rebuilt character by character will pass straight through.

# Don't do this — you are deliberately handing the value to whoever is looking.
def execute_action(context):
    return get_secret("MONDAY_API_KEY")[:4]

Use the secret to make the call, and return the result of the call.

Secret values cannot be read back through the dashboard, the REST API, or Copilot. get_secret inside a Python execution is the only way to read one — which is why an organization's Python is as trusted as the credentials it can reach.