> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/settings/managing-secrets-and-credentials.md). # Managing Secrets and Credentials The Secret Manager gives you a central, secure place to store API keys, passwords, tokens, and other sensitive credentials that your workflows depend on. Instead of hardcoding sensitive values directly into workflow steps, you define them once in the Secret Manager and reference them by name wherever they are needed. Secrets are encrypted at rest and resolved securely at runtime, so the plaintext value is never exposed in your workflow configuration. ### How it works When you save a secret, Harmony encrypts and stores the value separately from your workflow definitions. When a workflow runs, the runtime resolves the secret reference and injects the value at that moment - the plaintext never appears in your workflow configuration, logs, or exports. You reference a secret inside a workflow step using its name. If you later rotate the underlying value, every workflow that references that secret automatically picks up the new value the next time it runs, with no edits required to the workflows themselves. ### Accessing the Secret Manager 1. Open **Settings** from the main navigation. 2. Select **Secret Manager** from the Settings menu. The Secret Manager is accessible across all Harmony modules, so the same credentials can be shared between workflows without duplication. ### Adding a secret 1. In the Secret Manager, click **Add Secret**. 2. Enter a unique **Name** for the secret. This is the identifier you will reference inside your workflows, so choose a clear, descriptive name (for example, `payment_api_key` or `crm_bearer_token`). 3. Enter the **Value** - the actual credential or sensitive string you want to store. 4. Click **Save**. The value is encrypted immediately on save. After saving, the plaintext value is no longer displayed in the interface. ### Rotating a secret Rotating a secret updates its stored value without changing its name. Because workflows reference secrets by name, they automatically use the new value on their next run. 1. Find the secret you want to rotate in the Secret Manager list. 2. Click **Edit** next to that secret. 3. Enter the new value. 4. Click **Save**. All workflows that reference this secret will now resolve to the updated value at runtime. ### Deleting a secret Before deleting a secret, check its usage count to understand which workflows depend on it. Deleting a secret that is still referenced by active workflows will cause those workflows to fail at runtime. 1. Find the secret in the Secret Manager list. 2. Review the **Used in** count to see how many workflows currently reference it. 3. Click **Delete** and confirm the action. ### Tracking secret usage Each secret in the Secret Manager displays a usage count showing how many workflows are currently referencing it. Use this information to: * Identify unused secrets that can be safely removed. * Understand the blast radius before rotating or deleting a credential. * Audit which workflows depend on a particular third-party service. ### Using secrets in Workflow Builder Secrets are available inside the **HTTP Request** block in Workflow Builder. Instead of entering a raw credential value into a header or parameter field, you select the secret by name from the available references. 1. Open a workflow in Workflow Builder and add or edit an **HTTP Request** block. 2. In the field where you would normally enter a sensitive value (for example, an `Authorization` header value or an API key parameter), use the secret reference format to point to your stored secret. 3. Save the workflow. At runtime, Harmony resolves the reference and sends the actual credential value - without ever writing it into the workflow definition itself. ### Security considerations * **Encryption at rest** - All secret values are encrypted before being stored. * **Runtime resolution** - Plaintext values are only resolved at the moment a workflow step executes, and are never persisted in workflow configuration or run logs. * **Least-privilege access** - Only users with appropriate Settings permissions can create, edit, or delete secrets. * **Rotation without downtime** - Because workflows reference secrets by name, you can rotate credentials without editing or redeploying any workflow. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.harmony.io/settings/managing-secrets-and-credentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.