Secrets

Runyard keeps reusable credentials (API keys, deploy tokens) in an encrypted secret store on the Hub. Values are encrypted at rest, and the API is deliberately one-way: you can list secret names and metadata, set a value, and delete one — values are never returned by any list or read endpoint, to any scope.

Management (admin only)

# List names and metadata — never values
curl -H "Authorization: Bearer $RUNYARD_TOKEN" https://hub.example.com/api/secrets

# Create or update a secret
curl -X PUT -H "Authorization: Bearer $RUNYARD_TOKEN" -H "Content-Type: application/json" \
  -d '{"value": "…", "description": "Deploy token for the docs site"}' \
  https://hub.example.com/api/secrets/DOCS_DEPLOY_TOKEN

# Delete a secret
curl -X DELETE -H "Authorization: Bearer $RUNYARD_TOKEN" \
  https://hub.example.com/api/secrets/DOCS_DEPLOY_TOKEN

Secret names are env-var-safe identifiers, because that is exactly how they are delivered. The whole feature is gated on the store being enabled (an encryption key configured on the Hub); when it is not, secret-dependent runs and hooks report that configuration is required instead of failing obscurely.

How runs get secrets

A run receives the union of:

• the workflow's declared workflow.secrets list, and
• the run input's input.secretNames list.

Preflight verifies every named secret exists before the run is enqueued. At claim time — when a runner claims the run — the Hub decrypts exactly those named secrets into an env map that rides the claim payload, and the runner injects them only into the workflow's child process environment. That is the sole path a plaintext value ever leaves the store:

• Secrets never appear in run events, logs, or the run record.
• Stored secret values are additionally scrubbed from run output and artifacts before they are persisted.
• Payload fields with credential-like names are redacted in approval cards and other presentation surfaces.

Other consumers reference secrets by name only: hook profiles declare secretNames, and their readiness checks report missing names, never values.

API & MCP