Secrets

Secrets are credentials your Python needs — API keys, tokens, webhook URLs — stored once under Settings → Secrets and read by name at runtime.

Without them, a key that three actions need is pasted into three actions, shows up in version history, and has to be found and replaced everywhere when it rotates.

Saving through MCP

Use create_organization_secret with organizationId, name, value, and an optional description to save a new credential. Python can then read it with get_secret("NAME"). Existing names are rejected.

Use list_organization_secrets to find a secret's ID, then pass it as secretId to update_organization_secret or delete_organization_secret, along with organizationId. Updates accept any of name, description, or value; omit value to preserve the stored credential. Renaming requires updating Python references to the old name. Deleting makes the credential unavailable to Python.

The tools return metadata only and redacts the value from MCP logs and audit records. Your MCP client may retain the submitted value in its conversation history. Use the dashboard if you do not want to submit it through a client.

Using one

def execute_action(context):
    key = get_secret("MONDAY_API_KEY")

    response = requests.post(
        "https://api.monday.com/v2",
        headers={"Authorization": key},
        json={"query": "{ boards(limit: 1) { id name } }"},
        timeout=30,
    )
    response.raise_for_status()
    return response.json()

Full reference: get_secret.

Values cannot be read back

Once saved, a secret's value is write-only. It is not shown in the dashboard, not returned by the REST API, and not readable by Copilot. The only way to read it is get_secret inside a Python execution.

To help you confirm you saved the right thing, each secret shows a short code such as ****4f2a. That code is derived from the value by a one-way hash — it is not part of the secret, and it does not reveal any of it.

Editing a secret lets you change its name or description without re-entering the value. Leave the value field blank to keep the stored one.

How they are protected

• Encrypted at rest with AES-256-GCM. The stored form is authenticated, so a tampered value fails loudly rather than decrypting to something wrong.
• Only the secrets you ask for are transmitted to the Python sandbox, and only when a script actually calls get_secret.
• Scrubbed from output. Values are stripped from stdout, stderr and your action's return value before Octocom logs or displays them.

Anyone who can write Python in your organization can read that organization's secrets. That is the point of the feature, and it is worth remembering when you decide who gets access to the action editor.