7.8Logging in safely with secrets

A secret is a value, such as a password, that you store once in obsrvly and use by name. Chapter 8 shows how to create one. Never type a real password into a step.

Use a secret in a step#

• In a fill step, write ${NAME} as the value, for example ${LOGIN_PASSWORD}.
• In the dashboard, pick the secret from the secret… list next to the value. The list appears when your team has at least one secret.
• Use secrets only in fill steps. In other steps, ${NAME} is typed as plain text.
• Secret names use capital letters, digits and underscores. They start with a letter and have at most 64 characters, for example LOGIN_PASSWORD.
• You don't need to save the monitor again after you add the secret.

Allowed sites#

Each secret has a list of allowed sites. These are the only sites where obsrvly types it. The secrets page says: "Only pages and API requests on these sites can receive this secret, over https. Use *.example.com for all subdomains."

• The page must use https://, and its host must be on the list.
• Enter an exact host, such as app.example.com, or *. and a host, such as *.example.com for all its subdomains.
• Capital letters and port numbers do not matter.
• A secret with no allowed sites shows "No allowed sites: not usable". Select set allowed sites → to add some.

If a secret step fails#

Where secrets never appear#

• Results never show a secret's value. Every message shows ${NAME} instead.
• Screenshots never show a secret. If a secret could be seen on the page, no screenshot is kept (see 7.10).