Skip to main content

​
Store a secret

POST /api/secrets
Stores or updates an organization-level secret. Secrets are encrypted at rest and injected as environment variables at runtime. Body: 
{
  "name": "ANTHROPIC_API_KEY",
  "value": "sk-ant-..."
}
FieldRequiredDescription
nameYesEnvironment variable name (e.g., GEMINI_API_KEY)
valueYesSecret value
curl -s -X POST "https://dashboard.floom.dev/api/secrets" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "GEMINI_API_KEY", "value": "your-key-here"}'
If a secret with the same name already exists, it is overwritten.

​
How secrets work

  1. List required secrets in your manifest’s secrets_needed array
  2. Store them via this endpoint or in the dashboard under Settings
  3. At runtime, your run() function accesses them via os.environ["SECRET_NAME"]
import os

def run(query: str) -> dict:
    api_key = os.environ["GEMINI_API_KEY"]  # injected by floom
    # ...
Secrets are scoped to the organization. All automations in the same workspace share the same secret store.
Secrets are never exposed in logs, UI, or API responses. They are only available inside the sandbox during execution.