SHH! Conductor has secrets!
Tags: netflixconductor, orchestration, security, 2022
Published: 2022-08-09 13:38:13

---
title: SHH! Conductor has secrets!
published: true
date: 2022-08-09 00:00:00 UTC
tags: NetflixConductor,orchestration,security,2022
canonical_url: https://orkes.io/content/blog/conductor-has-secrets
---

We are really excited to announce the latest feature to Orkes' cloud hosted version of Netflix Conductor. It is now no longer a secret - we support the use of secrets in your workflow definitions! Now you can be certain that your secret keys, tokens and values that you use in your workflows are secure!

## What do you mean by secrets?[​](#what-do-you-mean-by-secrets "Direct link to heading")

In many of applications today, interaction with third party applications is common. Typically this will require some form of authentication to gain access. When you are coding, there is a concept of a local secure store where sensitive values are kept (and thus not shared to GitHub etc.) This prevents accidental disclosure of your secrets when posting code to GitHub or when sharing your code to other teams.

Until now, there has been no way to securely use any sensitive value in a Conductor workflow. Just about every developer has a story of accidentally posting a sensitive value on GitHub. Here's my story of accidentally sharing a sensitive value with a Conductor workflow:

In the [`order fulfillment` codelab](https://orkes.io/content/docs/codelab/orderfulfillment5#adding-a-error-flow), the failure workflow has a Slack token that is unique, and if publicly accessible could be used to SPAM a Slack channel. When writing the tutorial, I shared the task definition in the docs - _with_ the Slack token.

Slack caught this:

![aaccidently shared a hardcoded slack token](https://orkes.io/content/img/slack_oops.jpg)

Super embarrassing, but no serious consequences (in this instance).

## Don't let this happen to you! [​](#dont-let-this-happen-to-you "Direct link to heading")

In Orkes hosted instances of Netflix Conductor, we now feature secrets. You can save your secret on the Conductor server, and Conductor will _use_ the value when required, but will not expose the value in any outputs from the workflow.

It is a very easy setup - simply login to your instance of Netflix Conductor at Orkes (or try our [Playground](https://play.orkes.io) for free!). In the left navigation, click `Secrets`. This will lead to a table of your secrets (which is probably empty).

![the Orkes Cloud Secrets dashboard](https://orkes.io/content/img/secrets_dashboard.jpg)

Click `Add Secret`, give it a name, paste in your value, and press save. That's all there is to it.

## Using your secret[​](#using-your-secret "Direct link to heading")

In Conductor workflows, secrets use a similar format to other variables. For example, to reference an input variable called `address` you'd use `${workflow.input.address}`.

If you had a secret called `Stripe_api_key`, you reference this value with the variable `${workflow.secrets.Stripe_api_key}`.

## An example[​](#an-example "Direct link to heading")

Accessing GitHubs APIs requires an API token. In the following HTTP task, I call a GitHub API, and can reference the secret `Doug_github` for the authorization header.

```
{ "name": "Get_repo_details", "taskReferenceName": "Get_repo_details_ref", "inputParameters": { "http_request": { "uri": "https://api.github.com/repos/${workflow.input.gh_account}/${workflow.input.gh_repo}", "method": "GET", "headers": { "Authorization": "token ${workflow.secrets.Doug_github}", "Accept": "application/vnd.github.v3.star+json" }, "readTimeOut": 2000, "connectionTimeOut": 2000 } }, "type": "HTTP", "decisionCases": {}, "defaultCase": [], "forkTasks": [], "startDelay": 0, "joinOn": [], "optional": false, "defaultExclusiveJoinTask": [], "asyncComplete": false, "loopOver": [] }
```
<button type="button" aria-label="Copy code to clipboard" title="Copy"><span aria-hidden="true"><svg viewbox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewbox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button>

When this workflow is run, other variables are replaced, but the value of the secret remains a secret. Note that in the uri, `${workflow.input.gh_account}/${workflow.input.gh_repo}` is replaced with `netflix/conductor`, but the authorization header remains obfuscated.

```
{ "headers": { "Authorization": "token ${workflow.secrets.Doug_github}", "Accept": "application/vnd.github.v3.star+json" }, "method": "GET", "readTimeOut": 2000, "uri": "https://api.github.com/repos/netflix/conductor", "connectionTimeOut": 2000}
```
<button type="button" aria-label="Copy code to clipboard" title="Copy"><span aria-hidden="true"><svg viewbox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewbox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button>

## Conclusion[​](#conclusion "Direct link to heading")

Secrets have been one of the most requested features for Netflix Conductor when we speak to developers, and for that reason we're excited to announce this launch. We cannot wait to hear about how this release is making workflow development more secure and opening new avenues of development - now that these values can be securely stored.

Give them a try in the [Orkes Playground](https://play.orkes.io), and we w ould love to hear what you think in our [Slack](https://join.slack.com/t/orkes-conductor/shared_invite/zt-xyxqyseb-YZ3hwwAgHJH97bsrYRnSZg) or [Discord](https://discord.com/invite/P6vVt9xKSQ) communities