Secrets

Org secrets are encrypted key-value pairs that Colony Cloud injects into worker environments at runtime. Use them to supply API keys, tokens, and other credentials that your pipeline tasks need — without hardcoding them in your repository or configuration files.

Note

Secrets are encrypted at rest using AES-GCM. The plaintext value is never stored and cannot be retrieved after creation — only overwritten. If you lose a secret value, rotate it with a new one.

Add a secret

1. Open Settings → Secrets.
2. Click New secret.
3. Enter a name — uppercase letters, digits, and underscores only (e.g., OPENAI_API_KEY). Names must be unique within the organization.
4. Enter the value. The value field is masked and is never shown again after you save.
5. Click Save secret.

The secret is immediately available to all workers in the organization. Workers receive secrets as environment variables using the name you specified.

Tip

Use descriptive, SCREAMING_SNAKE_CASE names that indicate the service and credential type — for example, GITHUB_TOKEN, DATADOG_API_KEY, SENTRY_DSN. Avoid generic names like API_KEY that become ambiguous when the secret count grows.

Rotate a secret

Rotate a secret to replace its value without changing the name. Workers pick up the new value on their next task — no restart is needed.

1. Open Settings → Secrets.
2. Find the secret you want to rotate and click Rotate.
3. Enter the new value in the masked field.
4. Click Save.

The old value is discarded immediately upon saving. If your external service requires coordinating the rotation (for example, creating a new token before revoking the old one), complete that coordination in your service before rotating here.

Delete a secret

1. Open Settings → Secrets.
2. Find the secret you want to delete and click the ⋯ menu, then select Delete.
3. Confirm the dialog.

Caution

Deleting a secret takes effect immediately. Workers that depend on the deleted secret will fail on their next task. Disable any repos or tracks that rely on the secret before deleting it.