8.1What a secret is and when to use one
A secret is a named, encrypted value, such as a password, a token or an API key. Your team stores it once. After that, monitors use it by name.
To use a secret, you write a reference in the monitor: the secret's name inside ${ and }, such as ${PROD_API_TOKEN}. When the check runs, the reference is replaced by the real value.
Use a secret for any value you would not want others to read. For example:
- the password of a test account in a browser login check,
- an access token in the
Authorizationheader of an API monitor, - an API key in the body of a multi-step API request.
Secrets belong to your team. Every team member can create them and use them in monitors.
| Monitor type | Can use secrets? | Where |
|---|---|---|
| Browser | Yes | The value of a fill step |
| API (single request) | Yes | The URL, header values and the body |
| API multi-step | Yes | Each step's URL, header values and body |
| WebSocket | Yes | The URL, header values and the message it sends |
| URL | No | Use an API monitor instead (see 8.3) |
| TCP, UDP, ping, gRPC, DNS, certificate, domain, heartbeat | No | — |
Secrets are write-once. You see the value one time, when you create it. After that, nobody can read it back or change it in obsrvly.