Secrets

A secret is a stored credential, such as an API key for your billing tool. Once it’s in Settings → Secrets, chat and automations refer to it by name instead of holding the credential themselves. For keys that let your own software call Lightfield, see API keys.

Who can use it

Every plan. Only owners and admins see Settings → Secrets and can add or change secrets. Secrets belong to the workspace, so anyone’s chat or automation can use them. The agent can’t create secrets in chat.

What uses a secret

Both uses go through an HTTP request:

• Chat: when the agent sends an HTTP request for you, you approve it first (unless you’ve turned on auto-approval), and the request can use a secret.
• Automations: an automation’s HTTP request step can use a secret if the automation is allowed to make network requests. See Build an automation.

A request refers to a secret as ${WORKSPACE.MY_API_KEY}, and three rules apply:

• Headers only, unless you opt in. A secret goes in a request body only if Allow use in HTTP request bodies is ticked on it.
• HTTPS only. A request that uses a secret over plain HTTP is blocked.
• Allowed domains. When you set allowed domains, the request’s host must match one of them or it’s blocked. An empty list allows any host, so add the specific hosts the service uses.

Lightfield tries to hide a secret if a response echoes it back, but it can miss altered copies, so send secrets only to services you trust.

Add a secret

A secret’s name cannot be changed after saving. Choose a name you can keep in the requests that use it.

1. Go to Settings → Secrets and click New secret.
2. Under Name, type a name such as STRIPE_API_KEY: capital letters, numbers and underscores, starting and ending with a letter or number. Lowercase letters become capitals and spaces become underscores. The name must be unique and can’t be changed later.
3. Optionally add a Description, such as what uses it.
4. Under Allowed domains, type each host and press Enter, such as api.stripe.com. Use hostnames only, with no https:// or path. A host matches exactly, so slack.com doesn’t match api.slack.com; write *.slack.com for subdomains. Add at least one so the secret only goes where you expect. Left empty, Lightfield asks you to confirm with Add anyway, because the secret could go to any host.
5. Leave Allow use in HTTP request bodies off unless the service needs the secret in the body. Turning it on asks you to confirm, because a response can expose a body secret.
6. Paste the credential under Value. Show value reveals it.
7. Click Add secret.

Secret added confirms it, and the secret appears in the table with its Name, Allowed domains (All domains when there are none) and Last updated.

Update a secret

Removing or narrowing allowed domains stops automations that call a host you remove. Check which requests use the secret before changing its domains.

1. In the secret’s row, open the actions menu and choose Edit.
2. Change Description, Allowed domains or Allow use in HTTP request bodies.
3. Leave New value empty to keep the stored value, or paste a new one to replace it.
4. Click Update secret. Secret updated confirms the change.

Removing or narrowing allowed domains stops automations that call a host you removed. Lightfield warns Existing automations will stop working for those hosts, and you confirm with Save anyway. Lightfield never shows a saved value again, so keep the original in your own password manager.

Revoke or restore a secret

Revoking permanently erases the stored value, and anything that refers to the secret stops working. The secret stays in the table with its name struck through.

1. In the secret’s row, open the actions menu and choose Revoke.
2. In Revoke secret, click Revoke.

Secret revoked confirms it. To use the name again, choose Restore in the actions menu, paste a new value under Restore secret, and click Restore secret. The old value doesn’t come back.

Troubleshooting

I don’t see Secrets in Settings

Your role doesn’t include it. Ask an owner or admin to add the secret, or to make you an admin in Members.

I entered a new value, but the workflow still uses the old credential

Entering New value does not save the change. Click Update secret and wait for Secret updated. Replacing the value under the same secret name updates requests that refer to it; you do not need to create a second secret or change those references.

If you already saw that confirmation, check that the request references this secret’s exact name. A separately created secret has a different name and does not replace the old reference.

An automation’s HTTP request is blocked

• The host isn’t in Allowed domains. Edit the secret and add the host. slack.com doesn’t cover api.slack.com.
• The request uses plain HTTP. Use an https:// address.
• The secret is in the body. Tick Allow use in HTTP request bodies, or move the secret to a header.
• The secret was revoked. Choose Restore and paste a new value.

The service rejects the request with a 401 or 403

Check the credential and the authentication format the service expects. Some services want Bearer in front of the value and others want the token alone. If those match, use the service’s error details to check whether the credential has expired or lacks permission for the request.

Common questions

Can I change a secret’s name? No. Add a new secret with the name you want, update what refers to the old name, then revoke the old one.

Can members use a secret they can’t see? Yes. Members don’t see Settings → Secrets, but chat and automations in the workspace can use the secrets that exist.

Can I see a secret’s value after saving it? No. Lightfield never shows a saved value again. Paste a new value with Edit if you need to change it.