Using secrets in GitHub Actions

Secrets allow you to store sensitive information in your organization, repository, or repository environments.

Tool navigation

In this article

About secrets

Secrets are variables that you create in an organization, repository, or repository environment. The secrets that you create are available to use in GitHub Actions workflows. GitHub Actions can only read a secret if you explicitly include the secret in a workflow.

For secrets stored at the organization-level, you can use access policies to control which repositories can use organization secrets. Organization-level secrets let you share secrets between multiple repositories, which reduces the need for creating duplicate secrets. Updating an organization secret in one location also ensures that the change takes effect in all repository workflows that use that secret.

For secrets stored at the environment level, you can enable required reviewers to control access to the secrets. A workflow job cannot access environment secrets until approval is granted by required approvers.

Note: If your GitHub Actions workflows need to access resources from a cloud provider that supports OpenID Connect (OIDC), you can configure your workflows to authenticate directly to the cloud provider. This will let you stop storing these credentials as long-lived secrets and provide other security benefits. For more information, see "About security hardening with OpenID Connect"

Naming your secrets

The following rules apply to secret names:

  • Names can only contain alphanumeric characters ([a-z], [A-Z], [0-9]) or underscores (_). Spaces are not allowed.

  • Names must not start with the GITHUB_ prefix.

  • Names must not start with a number.

  • Names are case insensitive.

  • Names must be unique at the level they are created at.

    For example, a secret created at the environment level must have a unique name in that environment, a secret created at the repository level must have a unique name in that repository, and a secret created at the organization level must have a unique name at that level.

    If a secret with the same name exists at multiple levels, the secret at the lowest level takes precedence. For example, if an organization-level secret has the same name as a repository-level secret, then the repository-level secret takes precedence. Similarly, if an organization, repository, and environment all have a secret with the same name, the environment-level secret takes precedence.

To help ensure that GitHub redacts your secret in logs, avoid using structured data as the values of secrets. For example, avoid creating secrets that contain JSON or encoded Git blobs.

Accessing your secrets

To make a secret available to an action, you must set the secret as an input or environment variable in the workflow file. Review the action's README file to learn about which inputs and environment variables the action expects. For more information, see "Workflow syntax for GitHub Actions."

You can use and read secrets in a workflow file if you have access to edit the file. For more information, see "Access permissions on GitHub."

Warning: If a secret was used in the job, GitHub automatically redacts secrets printed to the log. You should avoid printing secrets to the log intentionally.

Organization and repository secrets are read when a workflow run is queued, and environment secrets are read when a job referencing the environment starts.

You can also manage secrets using the REST API. For more information, see "REST API endpoints for GitHub Actions Secrets."

Limiting credential permissions

When generating credentials, we recommend that you grant the minimum permissions possible. For example, instead of using personal credentials, use deploy keys or a service account. Consider granting read-only permissions if that's all that is needed, and limit access as much as possible.

When generating a personal access token (classic), select the fewest scopes necessary. When generating a fine-grained personal access token, select the minimum permissions and repository access required.

Instead of using a personal access token, consider using a GitHub App, which uses fine-grained permissions and short lived tokens, similar to a fine-grained personal access token. Unlike a personal access token, a GitHub App is not tied to a user, so the workflow will continue to work even if the user who installed the app leaves your organization. For more information, see "Making authenticated API requests with a GitHub App in a GitHub Actions workflow."

Note: Users with collaborator access to a repository can use the REST API to manage secrets for that repository, and users with admin access to an organization can use the REST API to manage secrets for that organization. For more information, see "REST API endpoints for GitHub Actions Secrets."

Creating secrets for a repository

To create secrets or variables on GitHub for a personal account repository, you must be the repository owner. To create secrets or variables on GitHub for an organization repository, you must have admin access. Lastly, to create secrets or variables for a personal account repository or an organization repository through the REST API, you must have collaborator access.

  1. On GitHub.com, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, select Secrets and variables, then click Actions.

  4. Click the Secrets tab.

    Screenshot of the "Actions secrets and variables" page. The "Secrets" tab is outlined in dark orange.

  5. Click New repository secret.

  6. In the Name field, type a name for your secret.

  7. In the Secret field, enter the value for your secret.

  8. Click Add secret.

If your repository has environment secrets or can access secrets from the parent organization, then those secrets are also listed on this page.

To learn more about GitHub CLI, see "About GitHub CLI."

To add a repository secret, use the gh secret set subcommand. Replace secret-name with the name of your secret.

gh secret set SECRET_NAME

The CLI will prompt you to enter a secret value. Alternatively, you can read the value of the secret from a file.

gh secret set SECRET_NAME < secret.txt

To list all secrets for the repository, use the gh secret list subcommand.

Creating secrets for an environment

To create secrets or variables for an environment in a personal account repository, you must be the repository owner. To create secrets or variables for an environment in an organization repository, you must have admin access. For more information on environments, see "Using environments for deployment."

  1. On GitHub.com, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the left sidebar, click Environments.

  4. Click on the environment that you want to add a secret to.

  5. Under Environment secrets, click Add secret.

  6. Type a name for your secret in the Name input box.

  7. Enter the value for your secret.

  8. Click Add secret.

To add a secret for an environment, use the gh secret set subcommand with the --env or -e flag followed by the environment name.

gh secret set --env ENV_NAME SECRET_NAME

To list all secrets for an environment, use the gh secret list subcommand with the --env or -e flag followed by the environment name.

gh secret list --env ENV_NAME

Creating secrets for an organization

Note: Organization-level secrets and variables are not accessible by private repositories for GitHub Free. For more information about upgrading your GitHub subscription, see "Upgrading your account's plan".

When creating a secret or variable in an organization, you can use a policy to limit access by repository. For example, you can grant access to all repositories, or limit access to only private repositories or a specified list of repositories.

Organization owners can create secrets or variables at the organization level.

  1. On GitHub.com, navigate to the main page of the organization.

  2. Under your organization name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.