Flow.Documentation
ProfessionalConnectionsSecrets and key vaults

Keep secrets in a vault

10 steps± 7 minVideoVerified 22 Oct 2026
  1. Step 1 · Open your development environment
  2. Step 2 · Create a secret
  3. Step 3 · Use it in a connection
  4. Step 4 · Call the API
  5. Step 5 · Add a new version
  6. Step 6 · The next call uses version 2
  7. Step 7 · Turn the old version off and see what uses it
  8. Step 8 · From a field to its secret
  9. Step 9 · This environment's AI keys
  10. Step 10 · Secrets in the security overview

You store a key or password once, with a name, in your environment's vault. Connections and workflows refer to that name; Flow never shows the value again, not even to you. A new key becomes a new version, used at the next call without a restart. In this guide you create a secret, use it in a connection, add a version and see who read it when.

Watch the whole guide as a video10 steps in one film
Step 1 / 10

Open your development environment

In the portal, under Environments, click Development, and there Open. Flow opens in a new tab and you are signed in straight away.

  1. Click Development
Open your development environment · Click Development
  1. Click Open ↗
Open your development environment · Click Open ↗
Step 2 / 10

Create a secret

Under Security → Secrets click ＋ New secret. The name is how everything refers to it: lowercase letters, digits and hyphens, and it never changes. Choose who may use it (the whole workspace, or only certain modules) and fill in the first value. Once saved, Flow never shows that value again.

  1. Click Security
Create a secret · Click Security
  1. Click Secrets
Create a secret · Click Secrets
  1. Click ＋ New secret
Create a secret · Click ＋ New secret
  1. In Name, type wholesaler-key
  2. In Description, type The wholesaler's API key
  3. In First value, type ••••••••
Create a secret · In Name, type wholesaler-key; In Description, type The wholesaler's API key; In First value, type ••••••••
  1. Click Create
Create a secret · Click Create
Create a secret · The secret, active, version 1, with its reference secret:… below it.
Step 3 / 10

Use it in a connection

Create a General HTTP API connection with Bearer token. Under Secret choose From the vault and then your secret: the connection only remembers the name. With Always the latest version it always uses the newest one.

  1. Click Connections
Use it in a connection · Click Connections
  1. Click General HTTP API
Use it in a connection · Click General HTTP API
  1. In Name, type Wholesaler · vault
  2. In Base URL, type http://127.0.0.1:62354/partner
  3. In Authentication, choose Bearer token
Use it in a connection · In Name, type Wholesaler · vault; In Base URL, type http://127.0.0.1:62354/partner; In Authentication, choose Bearer token
  1. Click From the vault
Use it in a connection · Click From the vault
  1. In Choose a secret, choose wholesaler-key · Version 1
Use it in a connection · In Choose a secret, choose wholesaler-key · Version 1
  1. Click Save
Use it in a connection · Click Save
Use it in a connection · The connection in the list: Key stored, in the vault.
Step 4 / 10

Call the API

A small workflow with the HTTP request step, your connection and the path /stock. When it runs, Flow takes the value from the vault, for that one call only.

  1. Click Add to General
Call the API · Click Add to General
  1. Click New workflow
Call the API · Click New workflow
  1. In Workflow name, type Stock through the vault
Call the API · In Workflow name, type Stock through the vault
  1. Click Add node
Call the API · Click Add node
  1. Click HTTP request
Call the API · Click HTTP request
  1. In Connection, choose Wholesaler · vault
  2. In URL or path, type /stock
Call the API · In Connection, choose Wholesaler · vault; In URL or path, type /stock
  1. Click the dot of ‘Event trigger’
Call the API · Click the dot of ‘Event trigger’
  1. Click the dot of ‘HTTP request’
Call the API · Click the dot of ‘HTTP request’
  1. Click Save
Call the API · Click Save
  1. Click Run
Call the API · Click Run
Call the API · GET → 200: the key from the vault works.
Step 5 / 10

Add a new version

When you get a new key, open the secret and click New version. The connection uses it at the next call, without setting it up again and without a restart. References pinned to a version (secret:name@1) keep using the old one.

  1. Click Security
Add a new version · Click Security
  1. Click Secrets
Add a new version · Click Secrets
  1. Click the secret ‘wholesaler-key’
Add a new version · Click the secret ‘wholesaler-key’
  1. Click New version
Add a new version · Click New version
  1. In Value, type ••••••••
Add a new version · In Value, type ••••••••
  1. Click Save
Add a new version · Click Save
Add a new version · Version 2 is the latest; version 1 is still below it.
Step 6 / 10

The next call uses version 2

Run the workflow once more. Under Reads you then find every time Flow used the secret: which run, which version and how it ended. The value itself is nowhere, not even in the run.

  1. Click the workflow ‘Stock through the vault’
The next call uses version 2 · Click the workflow ‘Stock through the vault’
  1. Click Run
The next call uses version 2 · Click Run
  1. Click Security
The next call uses version 2 · Click Security
  1. Click Secrets
The next call uses version 2 · Click Secrets
  1. Click the secret ‘wholesaler-key’
The next call uses version 2 · Click the secret ‘wholesaler-key’
  1. Click Reads
The next call uses version 2 · Click Reads
The next call uses version 2 · GET → 200 again, now with version 2.
Step 7 / 10

Turn the old version off and see what uses it

Once everything works with the new version, turn the old one off: nothing can use it afterwards. Under Used by you find the connections that use the secret, and through which workflows. Flow does not delete a secret that is still in use.

  1. Click Versions
Turn the old version off and see what uses it · Click Versions
  1. Click Disable
Turn the old version off and see what uses it · Click Disable
Turn the old version off and see what uses it · Version 1: Off.
  1. Click Used by
Turn the old version off and see what uses it · Click Used by
Turn the old version off and see what uses it · Connection ‘Wholesaler · vault’, via workflow ‘Stock through the vault’.
Step 8 / 10

From a field to its secret

Every place that uses a secret says which secret and which version: a connection, an API's security policy (a webhook's signature, the shared secret of JWT tokens) and the environment's AI keys. Open in Secrets takes you straight there.

  1. Click Connections
From a field to its secret · Click Connections
  1. Click Edit
From a field to its secret · Click Edit
From a field to its secret · ‘Uses secret wholesaler-key (version 2) · always the latest version’.
  1. Click Open in Secrets
From a field to its secret · Click Open in Secrets
From a field to its secret · The secret ‘wholesaler-key’ in Secrets.
Step 9 / 10

This environment's AI keys

Below the secrets are the environment's AI keys: per AI provider, the secret its key comes from. Without a choice, the key set in the portal counts. With Choose a secret you take one from the vault, or type a key: Flow keeps it as a secret and uses it at the next question to the model.

This environment's AI keys · AI keys of this environment, with Anthropic, Mistral and OpenAI.
  1. Click Choose a secret
This environment's AI keys · Click Choose a secret
  1. Click From the vault
This environment's AI keys · Click From the vault
This environment's AI keys · Choose the secret with the key; saving makes it Anthropic's key.
  1. Click Cancel
This environment's AI keys · Click Cancel
Step 10 / 10

Secrets in the security overview

Under Security → Security is the Secrets block: which secrets nothing uses any more, which (almost) expired, which with personal data are open to the whole workspace, and which are read most in the last 30 days, from the vault's log. You see names, dates and counts, never a value. A click on a name opens the secret.

  1. Click Security
Secrets in the security overview · Click Security
  1. Click Security
Secrets in the security overview · Click Security
Secrets in the security overview · The Secrets block: unused, expiring or expired, broadly shared and read most.
  1. Click the secret read most
Secrets in the security overview · Click the secret read most

This guide was carried out step by step on 22 Oct 2026 by an automated test on Flow (version 3e563176).