On this page
Return to top

Secrets

Secrets store encrypted values for use in node configuration via template tags — separately from Credentials (SMTP, OAuth, API auth profiles).

Secrets vs credentials

Secrets Credentials
Purpose Arbitrary secret strings (tokens, IDs, shared keys) Structured auth for mail / HTTP / webhooks
Template tag {{secrets.your_key}} Usually selected via credential pickers
UI Filament Secrets resource Filament Credentials resource

Use secrets when a node needs a raw value in a header, URL, or message body without creating a full credential record.

Creating a secret

  1. Open Voodflow → Secrets.
  2. Create a record with a stable key (e.g. stripe_webhook_secret).
  3. Paste the value; it is encrypted at rest in your database.

Using secrets in nodes

{{secrets.key}} resolves only on HTTP Request and Send Webhook (URL, headers, query, and body). Other nodes leave the tag unresolved so a secret cannot leak through mail, notifications, or PHP output.

TEXT 
Authorization: Bearer {{secrets.internal_api_token}}

Whitespace inside tags is allowed: {{ secrets.internal_api_token }}.

Security notes

  • Treat Filament access to Secrets like access to production credentials.
  • Resolved plaintext is tracked and replaced with [REDACTED_SECRET] in execution logs, dry-run output, and values passed downstream.
  • Do not log resolved tag values in custom PHP nodes. Custom nodes do not receive allow_secrets unless you opt in explicitly inside that node.
  • Rotate secrets by updating the value; workflows keep using the same key name.
  • Prefer Credentials for SMTP/OAuth so tokens stay out of free-text fields when a picker exists.