Secrets

WOML source contains symbolic secret names, never credential values.

Local commands

woml secrets set PAYMENTS_API_TOKEN
woml secrets list
woml secrets delete PAYMENTS_API_TOKEN

Run them from the project whose secret store you intend to use. The prompt hides plaintext. list prints names only.

Use secrets.NAME inside scripts and {{secrets.NAME}} in supported attributes. Reads must be literal and statically discoverable; enumeration and computed access are rejected.

Production providers include env, files, and production. Environment values use WOML_SECRET_<NAME>. Never commit .woml/, .env, mounted secret files, or literal credentials.

Store and reference a secret

Run the command from the workflow project:

woml secrets set PAYMENTS_API_TOKEN

The prompt masks input and stores the value outside workflow source. Use the symbolic name in JavaScript:

secrets.PAYMENTS_API_TOKEN

Use exact reference syntax in supported attributes:

secret="{{secrets.PAYMENTS_API_TOKEN}}"

The compiler discovers literal reads and injects only those required names. secrets[name], enumeration, and dynamic access are rejected.

Load production secrets

Choose one reviewed production source: environment variables, mounted secret files, or the production provider contract. An environment entry for PAYMENTS_API_TOKEN uses WOML_SECRET_PAYMENTS_API_TOKEN.

Do not confuse runtime secret loading with arbitrary environment access. context.env does not exist, and scripts cannot enumerate the secret store.

Keep values out of durable data

Never return, log, cache, store, include in URLs, or place secrets in notification message templates. A secret value passed to an external module remains the author's responsibility even though WOML redacts managed metadata.

Rotate credentials at their provider and update the WOML secret source. Validate provider identity afterward without printing the value.