---
metadata:
  - name: generator
    content: Diplodoc Platform v5.54.2
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/secrets.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/secrets.md
  - href: en/sourcecraft/operations/secrets.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt

# Managing secrets in a SourceCraft repository

<!-- source: en/_includes/sourcecraft/secrets-description.md -->
Using _secrets_, you can securely store encrypted confidential data, such as passwords, access keys, tokens, and more in the repository.

A secret consists of a key-value pair, where the key is the secret name, and the value, the confidential data.

Two types of secrets are supported:
* SourceCraft: Regular key-value secret stored in the service.
* Lockbox: Link to a [Yandex Lockbox](https://yandex.cloud/en/docs/lockbox/) secret. The secret itself is stored in Yandex Cloud, and SourceCraft accesses it via a [service connection](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md) using the latest current [version](https://yandex.cloud/en/docs/lockbox/concepts/secret#version) of the secret.
<!-- endsource: en/_includes/sourcecraft/secrets-description.md -->

For more information, see [Secrets](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets).

{% note tip %}

<!-- source: en/_includes/sourcecraft/service-connection-note.md -->
SourceCraft provides secure Yandex Cloud [API](https://yandex.cloud/en/docs/api-design-guide/concepts/general) authentication within [CI/CD](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md) workflows using [service connections](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md).
<!-- endsource: en/_includes/sourcecraft/service-connection-note.md -->

{% endnote %}

## Creating a secret {#create-secret}

1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, under ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace**, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories**.
1. Select a repository where you want to create a secret.
1. Under ![image](../../_assets/console-icons/gear.svg) **Repository settings** on the repository page, go to ![image](../../_assets/console-icons/vault.svg) **Secrets**.
1. On the page with secrets, click ![image](../../_assets/console-icons/plus.svg) **New secret**.
1. In the window that opens:
    * In the **Secret type** field, leave **SourceCraft**.

      {% note tip %}

      To create a secret that references a Yandex Lockbox secret, select the **Lockbox** type. For more information about such secrets, see [Setting up integration with Yandex Lockbox in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/lockbox-integration.md).

      {% endnote %}

    * In the **Name** field, enter a name for your secret.
    * In the **Value** field, enter a value for your secret.
1. Click **New secret**.

## Using the value of a secret in CI/CD {#use-secret-in-ci-cd}

<!-- source: en/_includes/sourcecraft/secrets-in-ci-cd.md -->
You can use secret values in the repository's [CI/CD processes](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md). To do this, in the `.sourcecraft/ci.yaml` configuration file, specify the secret in `${{ secrets.<secret_name> }}` format.
<!-- endsource: en/_includes/sourcecraft/secrets-in-ci-cd.md -->

{% note tip %}

For a Lockbox type secret, make sure to also specify the key from the Yandex Lockbox secret in `${{ secrets.<secret_name>#<key>}}` format. For more information, see [Setting up integration with Yandex Lockbox in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/lockbox-integration.md).

{% endnote %}

### Example {#example-secret-in-ci-cd}

This tutorial provides the `.sourcecraft/ci.yaml` configuration file for CI/CD, which runs when you create a pull request to the `master` branch and does the following:
1. Installs the [Yandex Cloud CLI](https://yandex.cloud/en/docs/cli/) and authenticates as a [service account](https://yandex.cloud/en/docs/iam/concepts/users/service-accounts) using an [authorized key](https://yandex.cloud/en/docs/iam/concepts/authorization/key) stored in the secret.
1. Authenticates in [Yandex Container Registry](https://yandex.cloud/en/docs/container-registry/) from `docker` using the [Docker credential helper](https://yandex.cloud/en/docs/container-registry/operations/authentication#cred-helper).
1. Builds a Docker image from the `Dockerfile` file and sends it to Container Registry.
1. Deploys a container in [Yandex Serverless Containers](https://yandex.cloud/en/docs/serverless-containers/) from the built Docker image.

<!-- source: en/_includes/sourcecraft/yc-ci-cd-serverless-ci-example.md -->
```yaml
# To run this CI/CD, create the following resources in Yandex Cloud:
# • Yandex Container Registry registry
# • Yandex Serverless Containers container
# • Service account with the serverless-containers.editor, 
#   container-registry.images.pusher, and iam.serviceAccounts.user roles
# • Authorized key to access Container Registry and Serverless Containers

on:
  pull_request:
    - workflows: ci-cd-container-registry-serverless
      filter:
        source_branches: ["**", "!test**"]
        target_branches: "master"

workflows:
  ci-cd-container-registry-serverless:
    tasks:
      - build-push-deploy-serverless
        
tasks:
  - name: build-push-deploy-serverless
    env:
      YC_DOCKER_REGISTRY_URI: cr.yandex/<registry_ID>
      IMAGE_NAME: <image_name>
      YC_SERVERLESS_CONTAINER_NAME: <container_name>
      YC_SERVICE_ACCOUNT_ID: <service_account_ID>
      YC_AUTHORIZED_KEY_JSON: ${{ secrets.<secret_name> }}
      YC_FOLDER_ID: <folder_ID>
    cubes:
      - name: install-yc
        script:
          - curl -o ./yc-install.sh -L https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash -s -- -a
          - echo 'source /root/yandex-cloud/completion.zsh.inc' >>  ~/.zshrc
          - chmod +x ./yc-install.sh && ./yc-install.sh -i /tmp/yc -n && mv /tmp/yc/bin/yc /usr/bin/yc
          - echo "$YC_AUTHORIZED_KEY_JSON" > key.json
          - yc config profile create sa-profile
          - yc config set service-account-key key.json
          - yc config set format json
          - yc config set folder-id $YC_FOLDER_ID
      
      - name: docker-login
        script:
          - yc container registry configure-docker --profile sa-profile

      - name: docker-build-push
        script:
          - docker build --tag $YC_DOCKER_REGISTRY_URI/$IMAGE_NAME --platform linux/amd64 .
          - docker push $YC_DOCKER_REGISTRY_URI/$IMAGE_NAME:latest
    
      - name: docker-logout
        script:
          - docker logout $YC_DOCKER_REGISTRY_URI

      - name: create-serverless
        script:
          - yc serverless container revision deploy  --container-name $YC_SERVERLESS_CONTAINER_NAME --image $YC_DOCKER_REGISTRY_URI/$IMAGE_NAME:latest --service-account-id $YC_SERVICE_ACCOUNT_ID
```
<!-- endsource: en/_includes/sourcecraft/yc-ci-cd-serverless-ci-example.md -->

For more information, see the [yc-ci-cd-serverless](https://sourcecraft.dev/sourcecraft/yc-ci-cd-serverless/) SourceCraft repository.

## Viewing a secret in the SourceCraft interface {#get-secret}

1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, under ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace**, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories**.
1. Select a repository where you want to view a secret.
1. Under ![image](../../_assets/console-icons/gear.svg) **Repository settings** on the repository page, go to ![image](../../_assets/console-icons/vault.svg) **Secrets**.
1. Click ![image](../../_assets/console-icons/ellipsis.svg) next to the secret you want to view.
1. Copy the value of the secret.

## Updating a secret {#edit-secret}

1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, under ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace**, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories**.
1. Select a repository where you want to change a secret.
1. Under ![image](../../_assets/console-icons/gear.svg) **Repository settings** on the repository page, go to ![image](../../_assets/console-icons/vault.svg) **Secrets**.
1. Click ![image](../../_assets/console-icons/ellipsis.svg) next to the secret you want to change.
1. In the **Value** field, enter a new value for the secret.
1. Click **Change**.

## Deleting a secret {#delete-secret}

1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, under ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace**, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories**.
1. Select a repository you want to delete a secret from.
1. Under ![image](../../_assets/console-icons/gear.svg) **Repository settings** on the repository page, go to ![image](../../_assets/console-icons/vault.svg) **Secrets**.
1. Select the secret you want to delete and click **Remove {name}** below.
1. In the window that opens, click **Remove {name}**.

#### Useful links {#see-also}

* [Setting up integration with Yandex Lockbox in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/lockbox-integration.md)
* [Secrets](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets)
* [Configuring CI/CD in a SourceCraft repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/ci-cd.md)