# Add Secrets and Variables to Shipfox Workflows (https://www.shipfox.io/docs/how-to/set-up-work/secrets-and-variables)

Description: Choose the right workspace value, bind it to a workflow step, and verify it without exposing a secret.

Use a variable for readable configuration and a secret for a credential. Both
are available to projects in the workspace.

## Before you begin [#before-you-begin]

You need access to workspace secret and variable settings.

## Create the values [#create-the-values]

1. Open **Settings → Variables** in the workspace.
2. Select **Create variable**.
3. Enter `DEPLOY_TARGET` as the key and `staging` as the value.
4. Save the variable.
5. Open **Settings → Secrets**.
6. Select **Create secret**.
7. Enter `NPM_TOKEN` as the key and the token as the value.
8. Save the secret. Shipfox does not show its value again.

## Bind and verify the values [#bind-and-verify-the-values]

Add this complete workflow to the project:

```yaml
# yaml-language-server: $schema=https://www.shipfox.io/docs/workflow.schema.json
name: Verify workspace values
runner: shipfox

triggers:
  manual:
    source: manual

jobs:
  check:
    steps:
      - env:
          TARGET: "${{ vars.DEPLOY_TARGET }}"
          TOKEN: "${{ secrets.NPM_TOKEN }}"
        run: |
          test -n "$TOKEN"
          printf 'Target: %s\n' "$TARGET"
```

Commit and push the workflow to the project's default branch, then start it from
the **Workflows** tab. The step must succeed and print `Target: staging`. It
checks that the token is present without printing the token.

If `DEPLOY_TARGET` is missing, Shipfox stops run creation. If `NPM_TOKEN` is
missing, Shipfox fails the step before the command runs. Fix the value in
workspace settings and start a new run. Storage, masking, scope, and supported
binding sites live in [Secrets and variables](https://www.shipfox.io/docs/reference/secrets-variables).