# Manage Secrets and Variables (https://www.shipfox.io/docs/how-to/set-up-work/secrets-and-variables)

Description: Create a workspace secret or variable, bind it to a workflow step, replace its value, or delete it safely.

Use a variable for readable configuration and a secret for a credential. Both
are available to projects in the workspace.

## Before you begin [#before-you-begin]

You need access to workspace secret and variable settings. To replace or delete
a value, you also need its exact key.

## Create the values [#create-the-values]

1. Open **Settings → Variables** in the workspace.
2. Select **Create variable**.
3. Enter `DEPLOY_TARGET` as the key and `staging` as the value.
4. Save the variable.
5. Open **Settings → Secrets**.
6. Select **Create secret**.
7. Enter `NPM_TOKEN` as the key and the token as the value.
8. Save the secret. Shipfox does not show its value again.

## Bind and verify the values [#bind-and-verify-the-values]

Add this complete workflow to the project:

```yaml
# yaml-language-server: $schema=https://www.shipfox.io/docs/workflow.schema.json
name: Verify workspace values
runner: shipfox

triggers:
  manual:
    source: manual

jobs:
  check:
    steps:
      - env:
          TARGET: "${{ vars.DEPLOY_TARGET }}"
          TOKEN: "${{ secrets.NPM_TOKEN }}"
        run: |
          test -n "$TOKEN"
          printf 'Target: %s\n' "$TARGET"
```

Commit and push the workflow to the project's default branch, then start it from
the **Workflows** tab. The step must succeed and print `Target: staging`. It
checks that the token is present without printing the token.

If `DEPLOY_TARGET` is missing, Shipfox stops run creation. If `NPM_TOKEN` is
missing, Shipfox fails the step before the command runs. Fix the value in
workspace settings and start a new run. [Context
availability](https://www.shipfox.io/docs/reference/contexts#context-availability) lists the fields that
accept `vars` and `secrets`.

## Replace a value [#replace-a-value]

Replace a value without changing its key. Keep the old external credential
active until workflows succeed with the new secret.

### Find affected workflows

Search workflow files for the exact key. A secret appears as
`${{ secrets.KEY }}` or `${{ secrets.local.KEY }}`. A variable appears as
`${{ vars.KEY }}`. Check all projects
in the workspace because workspace values are shared.

### Replace the value

Open **Settings → Secrets** or **Settings → Variables**. Open the key's menu
and select **Edit value**. Enter the full replacement value, then select
**Update secret** or **Update variable**. The old secret value cannot be
read back.

### Verify the replacement

Start one representative workflow for each distinct use of the value.
Confirm that every bound step succeeds and that logs do not expose a secret.

If the secret replaces an external credential, revoke the old credential only
after these runs pass. To rename a key, create the new key, update and sync all
workflow references, verify them, and then delete the old key.

## Delete a value [#delete-a-value]

Delete a workspace value only after no active workflow needs its key. A missed
reference can stop run creation or fail a step.

### Remove every dependency

Search every project for `${{ secrets.KEY }}`, `${{ secrets.local.KEY }}`,
or `${{ vars.KEY }}`. Replace
each match with a new key, remove the feature that needs the value, or
remove the workflow if it is no longer used.

Push the edits to each project's default branch and wait for every affected
workflow to sync. Check active runs before deleting a secret that a pending
step may still request.

### Delete the value

Open **Settings → Secrets** or **Settings → Variables**. Open the key's
menu, select **Delete**, and confirm the key shown in the dialog.

### Verify the removal

Confirm that the key no longer appears in workspace settings. Start each
affected workflow through its normal trigger. Confirm that run creation and
all bound steps succeed without the key.

A missed variable reference fails run creation. A missed secret reference fails
the step before its command runs. Restore the value if an urgent workflow still
needs it, then remove that dependency before retrying deletion.