Secrets

A secret is an API key or a password the bot passes to another service in a request from a script. A secret is kept in the bot's settings, not in the script's text, so it shows neither in the editor nor in an export of the flows.

How to add one

1. Open "Bot settings → Secrets".
2. In the "New secret" field give a name and a value and press "Add".

A name is Latin letters, digits and _, for example API_KEY. Once saved, the value is not shown: the field shows dots instead.

How to use one in a script

In a script a secret is secret. and its name: secret.API_KEY.

temp.resp = fetch("https://api.example.com/items", {
  headers: {Authorization: "Bearer " + secret.API_KEY}
})

A secret works only in a request: fetch(...), page_meta(...) and save_image(...). It can go into the address, the headers and the body. A script that reads a secret anywhere else, for example key = secret.API_KEY, is not saved.

What the script sees

The secret's value is put in only at the moment of the request. The script, the variables and a script run do not see it:

• a script run shows ‹secret.API_KEY› in its place;
• if a service returns the key in its answer (for example, repeats the request's headers), the bot replaces it with the text ‹secret.API_KEY› before it writes the answer to the variable. So the key reaches neither a message nor the session.

How to replace or delete one

• To replace a value, press the pencil in the secret's field, type the new value and press "Save the value".
• To delete a secret, press the bin next to its name. Scripts that use it will send their requests without it.