Secrets#

Overview#

A secret in Roboto holds sensitive information like an API key, a password, or another credential in a dedicated secret store. Actions use secrets during execution without the values passing through Roboto’s APIs.

Each secret is scoped to an organization and has a unique name within that organization.

You set a secret’s value when you create it. Neither the web UI nor the CLI displays that value afterward: both show only the secret’s name and metadata. The SDK still reads values, which is how an action resolves a secret parameter at runtime.

Creating Secrets#

You can create secrets through the web UI, CLI, or SDK.

Web UI:

Open Settings, go to the Secrets tab, and add a secret with its name and value.

CLI:

roboto secrets write my-api-key <secret-value>

SDK:

from roboto import Secret

# Create a new secret
secret = Secret.create(
    name="my-api-key",
    initial_value="sk-1234567890abcdef"
)

Using Secrets in Actions#

Actions can access secret values in two ways:

  1. Parameter References (Recommended)

    Reference secrets in action parameters using the roboto-secret:// URI format:

    # When invoking an action
action.invoke(
    input_data=[file_name],
    parameter_values={
        "api_key": "roboto-secret://my-api-key"
    }
)

    Or if you are using the web UI, you can reference the secret in the parameters section of the action invocation:

    Secret Parameter Reference

    In your action code, access the resolved value:

    from roboto import InvocationContext

context = InvocationContext.from_env()
api_key = context.get_parameter("api_key")  # Automatically resolved

  2. Direct Access

    Load secrets directly in action code:

    from roboto import Secret

secret = Secret.from_name("my-api-key")
api_key = secret.read_value().get_secret_value()

Secret URIs#

Secrets can be referenced using URIs in the format:

  • roboto-secret://secret-name (uses caller’s organization)

  • roboto-secret://secret-name@org_id (specific organization)

These URIs can be used anywhere a secret reference is needed, such as action parameters.

Managing Secrets#

List secrets:

roboto secrets list

If you belong to more than one organization, pass --org to choose one.

Delete a secret:

roboto secrets delete my-api-key

Security#

  • Secret values are stored in a secure secret store, not in Roboto’s databases

  • Values are never transmitted through Roboto’s APIs

  • Actions access secrets using temporary, scoped credentials

See the roboto secrets CLI for additional CLI information.

On this page