Hey there everyone, I need to grant a few new developers permissions to modify workflows, but I don’t want to expose all my secrets to them. Is this possible with Bitrise and if so, what is the best way to go about setting up permissions for this scenario.
1 Like
Hi @vidbina,
Thanks for asking this here! 
It’s possible to some extent, but not completely. The reason is: even if the developer doesn’t have access to the Secrets on the Web UI, they can access it during the build, so they can e.g. echo it.
It’s not possible to do it any other way, because if your build can access a Secret that means it have to be able to access the value and use it, and if you grant access to developers to modify the workflow they can modify it in a way that they can print/send/… the value.
This isn’t just a “Bitrise limitation”, it’s simply not possible technically to grant access to a value, but don’t grant access to someone who has access to the build configuration.
If all you want is that your developers don’t have access to the Secrets directly, on the Web UI, then you can e.g. store the build configuration in the repository, what the developers can access, and don’t grant Admin access to them on bitrise.io
With this they won’t be able to view/modify secrets on the Web UI, but they still can access it through builds.
If you’re interested in this solution, you can find the related docs (how to store the build config in the repo) on our DevCenter: Managing an app's bitrise.yml file - Bitrise Docs
If you have any questions just let us know!
Happy Building! 
Also worth to mention this Feature Requests, which can provide an easier solution in the future for not granting view access on the web UI for secrets:
Feel free to vote & comment there!
1 Like
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.