discover-secrets

Discover Secrets

Find and configure the right secrets for an SLX script by searching available workspace secrets and inferring from platform tags and existing SLX configurations.

How secrets work in RunWhen

Most secrets are not stored in RunWhen — they are configured locally on runner locations (private runners). The workspace secret list (get_workspace_secrets) returns key names that map to secrets already provisioned on the runner's filesystem or environment.

When a script runs, mapped secrets are injected as file paths in environment variables:

# In your script
token_path = os.environ.get("USER_TOKEN")  # This is a FILE PATH, not the value
with open(token_path) as f:
    token = f.read().strip()

The read_secret helper pattern handles both file-based (runner) and direct-value (local testing) cases:

def read_secret(env_var):
    val = os.environ.get(env_var, "")
    if val and os.path.isfile(val):
        with open(val) as f:
            return f.read().strip()
    return val.strip()

Discovery workflow

Step 1: List available secrets

get_workspace_secrets(workspace_name="my-workspace")

This returns vault key names when the workspace secrets API lists them. When the vault list is empty, the response includes secrets_from_slxs: env-var → workspaceKey patterns copied from committed SLX runbooks (e.g. k8s:file@secret/kubeconfig:kubeconfig).

Use secret_vars_for_author_run (full workspaceKey values) for run_script, run_script_and_wait, and commit_slx — not bare vault names like "kubeconfig": "kubeconfig" unless that value is already a workspaceKey. The MCP server auto-expands short keys when it can infer them from SLXs.

Step 2: Infer from platform and context

Secret names often follow naming conventions tied to the platform or environment:

Platform / Use Case	Likely secret names	Notes
Kubernetes	kubeconfig	Almost always present; the standard name
RunWhen PAPI (beta)	BETA-USER_TOKEN, beta_tok1	JWT tokens for beta environment
RunWhen PAPI (prod)	USER_TOKEN, PROD-USER_TOKEN	JWT tokens for production
GitHub	*-REPO-TOKEN, RUNWHEN-REPO-TOKEN	PATs for repo access
Slack	slack	Webhook URLs or bot tokens
GCP	*-sa, ops-suite-sa, gcp-*	Service account JSON keys
Azure	*-clientId, *-clientSecret, *-tenantId, *-subscriptionId	Azure SP credentials (often as a set of 4)