Variables and secrets

Variables let data flow through an automation. Wherever a field shows the variable picker, you can insert a reference instead of typing a fixed value—pulling in the trigger's data, an earlier step's output, or a value you defined yourself. Secrets are the same idea for sensitive values such as API keys and passwords: their values are encrypted and hidden from execution logs.

Referencing data in a field

Fields that accept variables are ordinary text boxes with two extra controls: a list of the field's own choices, and a button that opens the variable picker. Type a literal value directly, or insert a reference through either one. Through the picker you can reference:

• Earlier step output—fields from the trigger and any preceding node's output, such as an HTTP response's status or a content event's data.
• Variables—named values you defined for reuse.
• Secrets—named encrypted values.

The picker's detail pane describes whatever you select—its source and shape—before you insert it.

Inserted references appear as chips in the field, each labeled with the value's name and its source node—a secret's chip carries a lock. At run time each one resolves to its current value before the step executes. A field can mix references and literal text—for example, a subject line of New issue: followed by an issue-title reference.

If the node or field a reference points to is deleted, or the node's output changes shape so the field it named is no longer there, the chip turns stale: it stays in the field, but its tooltip explains why it no longer resolves. A stale reference resolves to nothing at run time, so reconnect it to a valid value before relying on that field.

Most references drill into one field of an earlier step's output. When you need the whole thing instead—for example, an object-shaped output with no single field that covers it, or a script's undeclared result—the picker also lists each in-scope node's entire output as a single reference, so you can forward it wholesale rather than picking it apart field by field.

Defining variables and secrets

Open the Variables page from the navigation to manage reusable values. It has two lists—Variables and Secrets—each with a Create New action; selecting an entry opens its form on the right.

• A variable holds a plain-text value.
• A secret holds an encrypted value. Because secrets are redacted from logs, give them a value long enough to be recognized and hidden.

Names are case-sensitive: apiKey, APIKEY, and apikey are three different variables.

Scope and precedence

Variables and secrets defined on the Variables page are available to every automation on the site. You can also define variables scoped to a single automation, which only that automation can use.

When a site-wide value and an automation-scoped value share the same name, the automation-scoped value wins. This lets one automation override a shared value without affecting the others.

warning

Store credentials and other sensitive data as secrets, never as plain variables. Only secret values are encrypted and kept out of execution logs.