Secrets
1. Overview
Secrets store sensitive values used by Flows, Backend Apps, and Frontend Apps — database passwords, API tokens, signing keys, etc. Unlike a Config Map, a secret's value can't be viewed once saved (it stays masked), even by someone with access to the screen.
Use Secrets whenever the value is a credential or sensitive data. For values that only need to be configurable per environment but aren't sensitive (like a URL), use a Config Map.
2. Creating a Secret
On the Secrets screen, the create button opens the New Secret form:
Basic Information
| Field | Required | Description |
|---|---|---|
| Secret | Yes | Name of the secret. Must follow Kubernetes conventions: lowercase letters, numbers, and hyphens only. Example: my-secret. |
| Type | Yes | Ownership scope of the secret. E.g. Squad. |
| Squad | Yes | Squad that owns the secret (shown when Type = Squad). Default: Default. |
| Description | No | Free-text description of the secret's purpose. |
Properties
A secret can have one or more properties — key/value pairs within the same secret. Click + Add Property to add a new one.
Each property has:
| Field | Description |
|---|---|
| Property Name | Name of the property within the secret (e.g. HOST, PASSWORD, TOKEN). |
| Values by Environment | A different value per environment (e.g. test, production). The value stays masked (•••), with an eye icon to temporarily reveal what was typed. |
This allows, for example, having a db-credentials secret with HOST, USER, and PASSWORD properties, each with a different value for test and for production.
Click Save to finish.
3. Using a Secret in Flows, Backend, and Frontend Apps
Once created, a secret needs to be explicitly bound to the Flow, Backend App, or Frontend App that will use it: each of them has a tab where you select which secrets (and/or config maps) that app can access. Without this binding, the secret isn't available for use, even though it exists on the platform.
Once bound, a property's value is accessed via the expression:
{$.env.secret_name.property_name}
For example, to access the PASSWORD property of the db-credentials secret:
{$.env.db-credentials.PASSWORD}
The value returned corresponds to the environment the Flow/App is running in (test, production, etc).
4. FAQ
Can I see a secret's value after it's saved? No — the value stays masked. You can only see what's being typed at the moment of creation/editing (eye icon), not the already-saved value.
What's the difference between a Secret and a Config Map? See the comparison in Config Maps.
Can a secret be used by more than one Flow or App? TODO: confirm whether the same secret can be bound to multiple Flows/Apps at the same time.