Secrets
Store API keys and tokens once, and reference them from Python without hard-coding credentials.
Secrets are credentials your Python needs — API keys, tokens, webhook URLs — stored once under Settings → Secrets and read by name at runtime.
Without them, a key that three actions need is pasted into three actions, shows up in version history, and has to be found and replaced everywhere when it rotates.
Using one
def execute_action(context):
key = get_secret("MONDAY_API_KEY")
response = requests.post(
"https://api.monday.com/v2",
headers={"Authorization": key},
json={"query": "{ boards(limit: 1) { id name } }"},
timeout=30,
)
response.raise_for_status()
return response.json()Full reference: get_secret.
Values cannot be read back
Once saved, a secret's value is write-only. It is not shown in the dashboard, not returned by the REST API, and not readable by Copilot. The only way to read it is get_secret inside a Python execution.
To help you confirm you saved the right thing, each secret shows a short code such as ****4f2a. That code is derived from the value by a one-way hash — it is not part of the secret, and it does not reveal any of it.
Editing a secret lets you change its name or description without re-entering the value. Leave the value field blank to keep the stored one.
How they are protected
- Encrypted at rest with AES-256-GCM. The stored form is authenticated, so a tampered value fails loudly rather than decrypting to something wrong.
- Only the secrets you ask for are transmitted to the Python sandbox, and only when a script actually calls
get_secret. - Scrubbed from output. Values are stripped from
stdout,stderrand your action's return value before Octocom logs or displays them.
Scrubbing recognises the value exactly as stored. A value you have sliced, encoded or rebuilt piece by piece will pass straight through — so never deliberately print or return a secret, even partially.
Anyone who can write Python in your organization can read that organization's secrets. That is the point of the feature, and it is worth remembering when you decide who gets access to the action editor.