Secrets

Local secret commands

Terminal

woml secrets set <NAME>
woml secrets list
woml secrets delete <NAME>

Names use uppercase symbolic form such as PAYMENTS_API_TOKEN. set prompts without echoing the plaintext value. list prints names only. Workflows refer to configured values with {{secrets.NAME}} in supported attributes or secrets.NAME in scripts.

Run secret commands from the project whose secret store you intend to use. Never commit .woml/, .env, mounted secret files, or literal credentials.

Production secret sources

The default is the local OS credential store. Production can select:

Terminal

WOML_SECRETS_PROVIDER=env woml run workflows/

WOML_SECRETS_PROVIDER=files \
WOML_SECRETS_DIRECTORY=/run/secrets \
woml run workflows/

Environment names map to WOML_SECRET_<NAME>. The files provider reads one secure regular file named exactly <NAME> from an absolute protected directory. WOML_SECRETS_PROVIDER=production checks mounted files, then environment, then the OS store. Conflicting values across sources fail activation. WOML resolves only names referenced by selected definitions.