Secret

A named credential for workflows. Chat cannot read it. Access puts the real value only on requests to the hosts you list.

This isn’t a connector. You don’t query it, and Chat can’t read it. You store the value once, name it, and let a workflow send it outbound.

Connect

Resources → New → Secret, or ask Chat:

Store a workflow secret called status-token for status.example.com.

Give it a name you’ll use in the workflow, like status-east or status-west.

What workflows can do

List the secret in resources. Inside run, call secret("the-name") and pass that into fetch. Access swaps in the real value only when the request host is on the allowlist.

export const workflow = {
  name: "status-check",
  resources: ["status-east", "status-west"],
};

export default async function run({ secret }) {
  const east = secret("status-east");
  const west = secret("status-west");
  const a = await fetch("https://east.example.com/health", {
    headers: { Authorization: `Bearer ${east}` },
  });
  const b = await fetch("https://west.example.com/health", {
    headers: { Authorization: `Bearer ${west}` },
  });
  return { east: a.ok, west: b.ok };
}

If the workflow didn’t list that name, secret() fails. If the host isn’t allowed, the real value is not sent.

Keep it safe

• Never paste the value into Chat. The form stores it; the agent never reads it.
• Allow only the hosts that should receive it.
• Prefer one secret per destination when east and west shouldn’t share a token.

See Workflows and Resources.