Hi @clee46,
That should work, if you don’t need those secrets in pull request builds. If you do need those in PR builds too, then right now the best solution is to use Generic File Storage, as those are available for PR builds too.
There’s a related feature request to let you control which secret env vars and files can be accessed in PR builds and which aren’t, if you want to feel free to vote & comment here:
Can you please clarify this a bit? What do you mean by Client?
In short, on bitrise.io all the admins but only the admins of the app can access and modify Secrets. In the build the secrets are available (except in PR builds), regardless of who started the build.
Last but not least, I think we don’t have a Feature Requests for per-workflow secrets but I think that would be quite useful too, so feel free to create one at http://discuss.bitrise.io/c/9-feature-request 