---
title: "Secrets, variables, keys, and environment vars"
slug: "secrets-variables-keys-environment-vars"
description: "Curious about secrets? Click here and get an in-depth demonstration of secrets, their variables, and how they are used."
tags: ["actions", "secrets"]
updated: 2026-10-22T21:25:39Z
published: 2026-10-22T21:25:39Z
canonical: "learn.allspice.io/secrets-variables-keys-environment-vars"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://learn.allspice.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets, Variables, Keys, and Environment Vars

## Secrets, Variables, and Keys demo

This documentation covers the `.allspice/workflows/04-Secrets-variables-keys.yml` workflow in the [Allspice Automations demo repo](https://hub.allspice.io/AllSpice-demos/Actions-Demo), demonstrating the use of secrets, variables, and how they are implemented to enhance security and functionality in continuous integration and deployment processes.

![Debug actions commit.](https://cdn.document360.io/3d44af5c-3f49-4ca5-b152-10836a885c13/Images/Documentation/Screenshot 2024-05-10 at 4.28.04 PM.png)

`.allspice/workflows/04-Secrets-variables-keys.yml`

```yaml
# Secrets, Variables, and Keys demo
# This workflow demonstrates how to use secrets, variables, and keys in the workflow
# Allspice Automations documentation: https://learn.allspice.io/docs/actions-cicd
name: Secrets-Variables-Keys-Demo
on: 
  push:
  issues:
    types: [opened, closed, reopened]

jobs:
  py-allspice test:
    runs-on: ubuntu-latest
    steps:
      # Check out repository code
      - name: "[📚->🖥️] Check out repository code"
        uses: actions/checkout@v3

      # Print repository action variable VARIABLE_NAME and value
      - name: Print repository Action variable 🔎
        run: |
          echo "Repository variable VARIABLE_NAME = ${{ vars.VARIABLE_NAME }}"
          echo "Repository variables are stored in ${{ allspice.server_url }}/${{ allspice.repository }}/settings/actions/variables"
      
      - name: Use Secret 🔎 
        # Store the secret in an environment variable YOUR_SECRET
        env:
          ENV_SECRET: ${{ secrets.YOUR_SECRET }}
      
        # Demonstrate how to use secrets in the workflow
        run: |
          echo "Secrets are stored in ${{ allspice.server_url }}/${{ allspice.repository }}"/settings/actions/secrets
          echo "Secrets are only available to the repository admins and the workflow"
          echo "Store API Tokens in secrets and use them in the workflow without exposing them"
          echo "Secrets are not printed to the terminal for security reasons and will be replaced with ***"
          echo "Using secret from /settings/actions/secrets YOUR_SECRET=${{ secrets.YOUR_SECRET }}"
          echo "Using secret from stored envrironmental variable ENV_SECRET=$YOUR_SECRET"        
```

## **Automations variables**

Variable allow you to configure text-based values that can change independently of the workflow files. Variables are for non-secret values.

To add a variable, visit Repository→Settings→Actions→Variables→Add

In this example, the variable name is `VARIABLE_NAME` and the value stored for the variable is `variable-value`

![Actions demo settings in variables management.](https://cdn.document360.io/3d44af5c-3f49-4ca5-b152-10836a885c13/Images/Documentation/Screenshot 2024-05-10 at 4.00.09 PM.png)

The workflow file prints the name of the variable and the value stored in the variable using `${{ vars.VARIABLE_NAME }}`

Additionally, this workflow will print the location of your repository automations variables.

```yaml
echo "Repository variable VARIABLE_NAME = ${{ vars.VARIABLE_NAME }}"
echo "Repository variables are stored in ${{ allspice.server_url }}/${{ allspice.workspace}}/${{ allspice.repository }}/settings/actions/variables"
```

### 

## Automations secrets

Secrets are very similar to variables, except once you store a value in the secret, you can’t read it using the web app, or in Automations. You can use the secret in your workflow and code, but the system will obscure any secret values. This allows you to store things like API tokens, passwords, and secure information without exposing it to other users.

Access to secrets is restricted to repository admins.

To add a secret, visit your repostory→Settings→Actions→Secrets→Add secret

![Actions demo repository settings. Under actions, secrects is selected. Page is titled secrets management with add secret to the right.](https://cdn.document360.io/3d44af5c-3f49-4ca5-b152-10836a885c13/Images/Documentation/Screenshot 2024-05-10 at 4.05.57 PM.png)

Here is a snippet showing the secret used in two ways. The first method calls the secret directly from `${{ secrets.YOUR_SECRET }}`. The second method stores the secret in an environmental variable and is called from the environmental variable.

```yaml
 name: Use Secret 🔎 
        # Store the secret in an environment variable YOUR_SECRET
        env:
          ENV_SECRET: ${{ secrets.YOUR_SECRET }}
      
        # Demonstrate how to use secrets in the workflow
        run: |
          echo "Secrets are stored in ${{ allspice.server_url }}/${{ allspice.repository }}"/settings/actions/secrets
          echo "Secrets are only available to the repository admins and the workflow"
          echo "Store API Tokens in secrets and use them in the workflow without exposing them"
          echo "Secrets are not printed to the terminal for security reasons and will be replaced with ***"
          echo "Using secret from /settings/actions/secrets YOUR_SECRET=${{ secrets.YOUR_SECRET }}"
          echo "Using secret from stored envrironmental variable ENV_SECRET=$YOUR_SECRET"        
```

## Using Environment Variables

Environment variables can be defined at different levels: workflow-wide, job-specific, or step-specific.

**Workflow-Wide Environment Variables:**

```yaml
env:

  Parts_lib: '/your-organization/Component-library.git'
```

**Job-Specific Environment Variables:**

```yaml
jobs:

  Design-Review:

    env:

      REVIEW_ENV: 'Schematic'
```

**Step-Specific Environment Variables:**

```yaml
steps:

  - name: Check PCB design environment

    run: kicad-cli check

    env:
      PCB_DESIGN_DEBUG: 'true'

  - name: Run hardware simulation
    run: ./simulate_hardware.sh
    env:
      SIMULATION_MODE: 'test'

  - name: Build firmware
    run: ./build_firmware.sh
    env:
      FIRMWARE_DEBUG: 'true'
```

## Debugging

Visit our [Automations debugging repository](/v1/docs/debugging-actions), to learn more about debugging secrets and Automations.