> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Learn how to access stored secrets in Liquid templates using the secrets variable for secure credential management in Rootly workflows and integrations.

The `secrets` variable lets you reference stored secrets — API keys, tokens, and passwords — inside Liquid templates. Instead of hardcoding sensitive values into your workflow configurations, you reference a secret by name and Rootly resolves the actual value at runtime, so the value itself never appears in your workflow definition.

## Variables

Rootly uses the [Liquid](https://shopify.github.io/liquid/ "Liquid") template language. The available variables are:

```ruby Ruby theme={null}

{{ secrets.name }} # returns secret value
```

## Usage

Secrets are most commonly used in workflow tasks that call external systems, such as HTTP request actions that need an authorization header. Because the expression is just Liquid, you can combine secrets with [filters](/liquid/filters) like any other variable. For example, to build a Basic authentication header:

```ruby Ruby theme={null}
Authorization: Basic {{ secrets.username | append: ':' | append: secrets.password | base64_encode }}
```

If your secrets are backed by the [HashiCorp Vault integration](/integrations/hashicorp-vault), values are read from Vault at runtime and JSON secret values are traversed using dot notation:

```ruby Ruby theme={null}
{{ secrets.SECRET_NAME.KEY_NAME }}
```

The key path in your template must match the JSON structure of the stored secret exactly, including case.

<Note>
  Managing secret definitions is restricted to Rootly owners and admins by default. If you need a new secret reference, ask an admin to create it for you.
</Note>

## Related pages

* [Liquid templating overview](/liquid/liquid) — how Liquid works in Rootly workflows
* [Liquid filters](/liquid/filters) — the full list of filters you can chain with secrets
* [HashiCorp Vault integration](/integrations/hashicorp-vault) — read secrets from your Vault cluster at runtime