Secrets and Variables

Store workspace variables, encrypted secrets, and API keys once so your automations can reference them by name. Use ordinary variables for non-sensitive settings and encrypted secrets or API keys for credentials. References keep credentials out of saved field text, but the automation receives the plaintext value when it uses them.

At a glanceVerified in app · Oct 30, 2026

Use it to

Store plain Variables, encrypted Secrets, and API keys once for reuse across workspace automations

Find it

Left sidebar → Variables

Limits

Key names: 1 to 64 uppercase characters [A-Z0-9_] · Blocked in unsafe sinks (SECRET_IN_UNSAFE_SINK)

Output

{{ $var.NAME }}, {{ $secret.NAME }}, {{ $key.NAME }}

Instead

Custom Variables Step (for temporary values scoped to a single run)

Finding them

Select Variables in the workspace sidebar, then open Team. If the workspace has no shared values, the page shows an introduction with cards for variables, secrets, and API keys. The preview rows are examples, not saved values. Admins and Managers can select a type card to open its creation form. Members can read the introduction but cannot create values.

After the first value is saved, the table, search, and filter controls appear. Use Filter to select a type, or search by key, ordinary variable value, or the name of an automation that uses it. Hidden values are not searched.

Select the automation count beneath a key to see the automations and Steps that reference it. This list respects automation visibility and excludes archived automations; an empty list is not proof that no running or suspended execution still needs the key.

The System tab lists read-only values provided by Glow. Create shared values on Team, not System.

Create a variable, secret or API key

Admins and Managers can create shared values using the same form.

Type	Value field	Save action	Example reference
Variable	Value	Create variable	{{ $var.REGION }}
Secret	Secret value	Create secret	{{ $secret.SIGNING_SECRET }}
API key	Key	Create API key	{{ $key.STRIPE_API_KEY }}

Variables store plain text, including multiline text and pasted JSON; JSON is not converted into an object. Secrets and API keys are encrypted before storage and hidden in the table. Creating an API key here stores an existing credential; it does not issue one at the provider or create an app connection.

Admins and Managers can use Reveal value in a hidden value’s row menu to show it for 10 seconds, or Hide to conceal it sooner. Each reveal is audited.

Referencing secrets in automations

Copy the exact reference from Syntax into a Step field that supports dynamic values, such as an HTTP authorization header. Include both $ and double braces: a secret named SIGNING_SECRET uses {{ $secret.SIGNING_SECRET }}. Rotation keeps the same type, key and reference.

Rotate, update, or delete a value

As an Admin or Manager, open Variables → Team and use the row’s three-dot menu:

Security notes and limits

Setting or limit	Rule
Name (key)	1 to 255 characters; uppercase letters, numbers, and underscores ([A-Za-z0-9_]+), unique across the workspace
Value (value)	1 to 65,536 characters (64 KiB UTF-8)
Description	Up to 1,024 characters
Reveal window (Reveal value)	Shows a hidden Secret or API key value for 10 seconds (Admin and Manager only; every reveal is audited)
Runtime cache after edit/rotate	Running Steps can reuse the previous value for up to 10 seconds after a rotation or edit

• Automated multi-encoding log redaction: Run processing replaces exact secret values (plus JSON-escaped, URL-encoded, Base64, and hex encodings of secrets 6 characters or longer) in results and errors with [REDACTED]. If the workspace’s secret list cannot be read, Glow fails closed and withholds the Step output ([withheld: secret redaction unavailable]). As a defense-in-depth practice, never print or return raw credentials in Step outputs.
• Cross-workspace exports: Credentials do not transfer when moving an automation to another workspace. Create destination credentials and verify references before running.
• Role access: Only Admins and Managers can create, edit, reveal, rotate, or delete values. Members can reference all team variables in automations (Use team variables (values hidden)). In the Variables table, Secret and API key values are masked (••••••••••••) and cannot be revealed by Members, while plain Variable ({{ $var.NAME }}) values remain visible. Viewers have no access to the Variables page.

Verify it works

Run

Create a Variable or Secret on the Variables page and reference it as {{ $var.NAME }} or {{ $secret.NAME }} in a Step

You should see

The Step resolves the value at runtime, while Secret and API key values appear as [REDACTED] in logs.

What’s Next?

• Compare connections, secrets, workspace variables, files, and literals in Where Data Lives.
• Reference a secret correctly inside a step using the Variable Reference Syntax.
• Hold run-scoped values that do not belong in a secret with Custom Variables.