Secrets

Secrets store sensitive values – credentials, API tokens, passwords – securely at the team level, so labs can use them without the values ever appearing in lab configuration or content.

Secrets are write-only: once saved, the value can’t be read back by anyone. Labs reference a secret by name, and the platform resolves the value at runtime.

Team Owners create and manage secrets. Content creators use them in labs.

View your team’s secrets

In the sidebar, click Building blocks → Secrets.

The table shows each secret’s name, when it was last modified, who modified it, and where it’s used – never the value.

Add a secret

1. In the sidebar, click Building blocks → Secrets.
2. Click Create.
3. In the Name field, enter the secret’s name. Names accept letters, numbers, and underscores (for example MY_API_KEY).
4. In the Description field, describe what the secret is for. Keep it brief but clear – this is what tells content creators how to use it.
5. In the Value field, enter the secret value.
6. Click Save changes.

Update a secret

1. In the sidebar, click Building blocks → Secrets.
2. Click ••• on the secret and select Update.
3. Enter the new value – the value is always required when updating. To change only the description, re-enter the current value.
4. Click Save changes.

Delete a secret

1. In the sidebar, click Building blocks → Secrets.
2. Click ••• on the secret and select Delete.
3. Click Confirm.

Caution

A deleted secret’s value can’t be recovered, and labs that reference it will fail to resolve it. Check the “used in” column before deleting.

Use a secret in a lab

A lab references a secret by name through a secret resource. In the lab editor, open the Dynamic values tab, add a Secret, give it an internal name, and pick the team secret from the list. The lab stores a reference to the secret, not its value.

In lab configuration, the same looks like this:

resource "secret" "api_key" {
  reference = "MY_API_KEY"
}

resource "container" "app" {
  image {
    name = "myapp:latest"
  }

  environment = {
    API_KEY = resource.secret.api_key.value
  }
}

For all fields and more examples – injecting secrets into containers, exec scripts, and private registry credentials – see the Secret resource reference and Dynamic values.

Secrets on virtual machines

The only way to deliver a secret to a VM today is through its environment map, and those values are readable by any learner with terminal access on the VM - see Environment Variables and Secrets in the VM reference. Only pass a secret to a VM if the learner is allowed to see it.