Skip to content
Go to dashboard

8.3Use a secret in a monitor

Write ${SECRET_NAME} where you want the value, with the secret's real name in place of SECRET_NAME. Follow these rules:

  • Write the dollar sign, the braces and the name in capitals, exactly as the secret is named.
  • A name in lower case, such as ${api_token}, is not a reference. It is sent as written.
  • A reference can sit inside other text, such as Bearer ${API_TOKEN}.
  • Do not confuse it with {{name}}. That is a value taken from an earlier step of a multi-step API monitor.

Browser monitors#

Use a secret only in the value of a fill step (chapter 7). Other steps, such as goto, click and assert_text, do not replace references.

  1. In the monitor's steps list, add or open a fill step.
  2. Open the secret… list next to the value box and pick a secret. This puts ${NAME} in the value box. It replaces what was there.

You can also type the reference yourself. In the API, a fill step looks like this:

Fill step that uses a secret
json
{"kind": "fill", "selector": "input[name=password]",
 "value": "${LOGIN_PASSWORD}"}

API monitors#

In an API monitor, write ${NAME} in the URL, in a header value or in the body. In a multi-step API monitor, you can do this in every step. Header names cannot use secrets.

Header value that uses a secret
Authorization: Bearer ${PROD_API_TOKEN}

WebSocket monitors#

In a WebSocket monitor, write ${NAME} in the URL, in a header value or in the message it sends. The secret is sent only over wss://. Header names cannot use secrets.

What you see when the check runs#

  • In results and error messages, the value is replaced by its reference, such as ${PROD_API_TOKEN}.
  • If a failed browser check was showing a secret on the page, no screenshot is kept. The result shows "No screenshot: the page was showing a secret."
  • If you create the secret after the monitor, monitors that already use the name pick it up. You do not need to save them again.

If the secret name does not exist:

  • A browser check fails at the fill step with secret <NAME> has no allowed sites. The monitor still saves, so check the spelling.
  • An API check sends the text ${NAME} as written. The target's reply shows the mistake, for example a login error.

A failed check alerts as your alert policy says (chapter 9).

Last updated