Reference secrets instead of inlining them
env: and ${ENV:VAR} references resolve at run time, so no key is ever written into a graph or preset.
Secret fields take a reference, not a value. Two forms are accepted, and both are resolved by the agent when the run starts.
env:STRIPE_API_KEY
${ENV:STRIPE_API_KEY}- Run presets keep only references. An inline key is stripped when the preset is saved and blocks Run until replaced.
- The credential picker suggests references from the catalog's suggested variable for a field, or infers one from the node type or integration subtype.
- Workspace settings lists the secret references the workspace expects, which is the place to check a name before using it.
- A reference to a variable the agent does not have fails at run time — the failure names the missing variable.
Related
- Tokens and keys for integrationsCredentials & modelsStore the API keys your graphs need per service, and reuse them across graphs.
- Run configuration and presetsRunning & debuggingPer-node arguments for a run, saved as named presets you can duplicate, export, and seed from the last run.
- Configure a node in the inspectorGraph editorThe inspector holds a selected node's identity, configuration, connection and authorization settings, and its run defaults.
More in Credentials & models · Search all help