# Proper place to set "secret" environment variables **URL:** \ **Category:** Question & Answer\ **Created:** [June 26, 2017, 11:14pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099 "2017-06-26T23:14:32Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![clee46](https://avatars.discourse-cdn.com/v4/letter/c/c89c15/32.png) [@clee46](https://discuss.bitrise.io/u/clee46)\ **Post date:** [June 26, 2017, 11:14pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/1 "2017-06-26T23:14:32Z")
Am a little confused about where I should set private environment variables, such as our Facebook App ID/secret or Heroku server endpoints, which we want to vary by workflow. My current setup is I have a workflow that runs when I push to our development branch and a different workflow that runs when I push to our production branch. I’ve defined keys for Facebook ID/secret and Heroku endpoints, and whose values vary based upon the workflow. My question is - is this the proper place to define these variables? If so, then what types of variables would be defined in the Secret tab? If I should be defining the above variables in the Secret tab, then how can I define them so that they vary based upon which workflow is running? Thanks for the help! ---
**Author:** ![godreikrisztian](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/godreikrisztian/32/22_2.png) [@godreikrisztian](https://discuss.bitrise.io/u/godreikrisztian)\ **Post date:** [June 28, 2017, 1:30pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/2 "2017-06-28T13:30:07Z")
Hi @clee46, thanks for the question! > [@clee46](#): > > My question is - is this the proper place to define these variables? If so, then what types of variables would be defined in the Secret tab? You should define your secret variables on Secrets tab (in Workflow Editor). These variables are not part of your bitrise config (bitrise.yml), instead they are stored separately. For security reasons these variables are not applied in case of pull request, to avoid malicious access to secret infos. > [@clee46](#): > > If I should be defining the above variables in the Secret tab, then how can I define them so that they vary based upon which workflow is running? The secrets env vars are config level variables, so you can not define it per workflow. Possible workaround is to prefix/suffix the variable names based on in which workflow you want to use them. Read more in devcenter: [Managing Secrets locally - Bitrise Docs](http://devcenter.bitrise.io/bitrise-cli/secrets/) ---
**Author:** ![clee46](https://avatars.discourse-cdn.com/v4/letter/c/c89c15/32.png) [@clee46](https://discuss.bitrise.io/u/clee46)\ **Post date:** [June 28, 2017, 9:55pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/3 "2017-06-28T21:55:43Z")
Thanks for your reply! A little confused about workflow env vars. Can the client access these? Below is my current idea, but it all depends on whether the client can access the workflow env vars. If it cannot, is there no way that a client can “know” which environment variables to use based upon which branch it was built from? 1. Set all the secret env vars for all environments in the Secrets tab, using prefixes to distinguish which environment. (i.e. DEV\_FACEBOOK\_ID, PROD\_FACEBOOK\_ID, etc.). 2. We define a workflow env var “CLIENT\_ENV” whose value is “development” for the development workflow and “production” for the production workflow, etc… 3. If I push to the development branch, Bitrise triggers a build using our development workflow. 4. Based upon the value of “CLIENT\_ENV”, the client then programmatically determines which secret env vars to use. For example, if the environment is development, it knows to use DEV\_FACEBOOK\_ID, DEV\_FACEBOOK\_SECRET, etc. ---
**Author:** ![viktorbenei](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/viktorbenei/32/18_2.png) [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Post date:** [June 29, 2017, 11:29am UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/4 "2017-06-29T11:29:19Z")
Hi @clee46, That should work, if you don’t need those secrets in pull request builds. If you do need those in PR builds too, then right now the best solution is to use Generic File Storage, as those are available for PR builds too. There’s a related feature request to let you control which secret env vars and files can be accessed in PR builds and which aren’t, if you want to feel free to vote & comment here: > [@Secret Env Vars and (Generic) File Storage files: control whether it's available in Pull Request builds](http://discuss.bitrise.io/t/secret-env-vars-and-generic-file-storage-files-control-whether-its-available-in-pull-request-builds/718): > > From Guido Marucci Blas on 2016/02/03 15:08:20 +0000 Currently secret env variables are not available for any PR no matter if it is an internal PR or a PR from a forked repo. I would be nice to have grained control over this and allow secret en variables to be visible for PR from the same repo. Copied from original feature request: [http://bitrise.uservoice.com/forums/235233-general/suggestions/11701587-make-secret-env-variables-available-for-prs-from-t](http://bitrise.uservoice.com/forums/235233-general/suggestions/11701587-make-secret-env-variables-available-for-prs-from-t) > [@clee46](#): > > Can the client access these? Can you please clarify this a bit? What do you mean by Client? In short, on [bitrise.io](http://bitrise.io) all the admins but only the admins of the app can access and modify Secrets. In the build the secrets are available (except in PR builds), regardless of who started the build. Last but not least, I think we don’t have a #Feature Requests for per-workflow secrets but I think that would be quite useful too, so feel free to create one at [http://discuss.bitrise.io/c/9-feature-request](http://discuss.bitrise.io/c/9-feature-request) 😉 ---
**Author:** ![clee46](https://avatars.discourse-cdn.com/v4/letter/c/c89c15/32.png) [@clee46](https://discuss.bitrise.io/u/clee46)\ **Post date:** [June 29, 2017, 7:45pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/5 "2017-06-29T19:45:10Z")
> [@viktorbenei](#): > > Can you please clarify this a bit? What do you mean by Client? Sorry, by client, I meant the app itself. So, let me step back and outline the entire deployment strategy we hope to achieve: 1. We have a single repository containing a Xamarin project with both iOS and Android apps. 2. The repository has a development branch, a QA branch and a production branch. 3. Each of these client branches is linked to a different server/DB, Facebook app, etc. so that when a change to one of these branches triggers a new build, the resulting app “knows” to connect to its respective server/DB or Facebook app. The proposal in my last post should be able to achieve this, but it all hinges on whether the app can access Workflow Environment Variables. Can you confirm that this is the case? > [@viktorbenei](#): > > the best solution is to use Generic File Storage I read through your docs on Generic File Storage, but it seems overly complex way to store a Facebook APP ID/secret or a Heroku server endpoint. Is this the recommended method? If so, can you point me towards a tutorial or propose how I would use Generic File Storage in this use case? ---
**Author:** ![viktorbenei](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/viktorbenei/32/18_2.png) [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Post date:** [June 29, 2017, 7:53pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/6 "2017-06-29T19:53:25Z")
> [@clee46](#): > > The proposal in my last post should be able to achieve this, but it all hinges on whether the app can access Workflow Environment Variables. Can you confirm that this is the case? Well, sure it (build steps and tools) can **during the build**. If you want to include a secret in a deployable app (ipa / apk) then you’ll have to include that secret **in the app** , e.g. by writing it into a file which is compiled into the app - that’s why I suggested Generic File Storage. With that you can define these values in e.g. a JSON file which you embed / compile into the app, and so the deployed app can read those. ---
**Author:** ![viktorbenei](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/viktorbenei/32/18_2.png) [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Post date:** [June 29, 2017, 7:55pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/7 "2017-06-29T19:55:31Z")
I’d also suggest you to ask this another way: if you have to do this locally on your Mac, how do you handle it there? That’s (usually) exactly how you can on [bitrise.io](http://bitrise.io) too, just in an automated way 🙂 ---
**Author:** ![clee46](https://avatars.discourse-cdn.com/v4/letter/c/c89c15/32.png) [@clee46](https://discuss.bitrise.io/u/clee46)\ **Post date:** [June 29, 2017, 8:25pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/8 "2017-06-29T20:25:13Z")
OK, I think I get it! So, if I understand correctly, I would need to create and upload a separate JSON file for each set of env variables. For example, a dev\_vars.json, qa\_vars.json, prod\_vars.json each with their respective secrets. Each json has its own unique download URL, so I can then use each download URL in its respective workflows. For example, development workflow would be configured to download dev\_vars.json. So end-to-end: a change to development branch triggers development workflow which downloads development json with all the secrets needed to connect to development server/DB/facebook app, etc. I guess the last piece of the puzzle - can you point me to where in the workflow should the JSON be downloaded and what step allows me to do that? Thanks for all your help and for the quick replies! 🙂 ---
**Author:** ![viktorbenei](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/viktorbenei/32/18_2.png) [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Post date:** [June 29, 2017, 8:27pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/9 "2017-06-29T20:27:05Z")
> [@clee46](#): > > I guess the last piece of the puzzle - can you point me to where in the workflow should the JSON be downloaded and what step allows me to do that? There are quite a few possibilities, you can find a couple of examples here: [Using files in your builds - Bitrise Docs](http://devcenter.bitrise.io/tutorials/how-to-use-the-generic-file-storage/) About where: most likely after the **Git Clone** step, as that’s the point where your source code is retrieved, and before the build step you use as that’s where you’ll want to use/have that file available 😉 > [@clee46](#): > > Thanks for all your help and for the quick replies! 🙂 Any time 😉 ---
**Author:** ![benrnz-sv](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/benrnz-sv/32/349_2.png) [@benrnz-sv](https://discuss.bitrise.io/u/benrnz-sv)\ **Post date:** [August 8, 2017, 11:03pm UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/10 "2017-08-08T23:03:02Z")
Hi, I’m looking at using the Secret Vars, but I was very surprised to see that they are not masked and any user with Workflow edit access can see the secret value. I expected these to be more like Octopus where once the value is entered, you cannot see it again. Can this please be tightened up by masking the value so it is not readable once entered? Currently I believe this violates our security policy so I’m not able to use a few steps that I’d really like to use. Cheers Ben ---
**Author:** ![viktorbenei](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/viktorbenei/32/18_2.png) [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Post date:** [August 9, 2017, 6:46am UTC](https://discuss.bitrise.io/t/proper-place-to-set-secret-environment-variables/2099/11 "2017-08-09T06:46:16Z")
> [@benrnz-sv](#): > > Can this please be tightened up by masking the value so it is not readable once entered? The thing about this is that those values will be available in the build anyway, so if someone has access to the editor they can easily print that by modifying the workflow and starting a build which either prints the value or just sends it to somewhere. That said, for the web UI there’s a related #Feature Requests if you’re interested @benrnz-sv : > [@Provide write-only Secret Env Vars on bitrise.io (don't show the value on the Web UI after it's set)](http://discuss.bitrise.io/t/provide-write-only-secret-env-vars-on-bitrise-io-dont-show-the-value-on-the-web-ui-after-its-set/146): > > From @kartikbb on Tue Oct 18 2016 08:41:55 GMT-0400 (EDT) As of now, all admins can see the apple account username and password in “Deploy to ItunnesConnect” step which is big security issue. Ideally, the password should not be displayed in plain text in the workflow editor. It should be masked. Copied from original issue: [https://github.com/bitrise-io/bitrise.io/issues/80](https://github.com/bitrise-io/bitrise.io/issues/80)