Secrets

Store a secret

POST /api/secrets

Stores or updates an organization-level secret. Secrets are encrypted at rest and injected as environment variables at runtime. Body:

{
  "name": "ANTHROPIC_API_KEY",
  "value": "sk-ant-..."
}

Field	Required	Description
`name`	Yes	Environment variable name (e.g., `GEMINI_API_KEY`)
`value`	Yes	Secret value

curl -s -X POST "https://dashboard.floom.dev/api/secrets" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "GEMINI_API_KEY", "value": "your-key-here"}'

If a secret with the same name already exists, it is overwritten.

How secrets work

List required secrets in your manifest’s secrets_needed array
Store them via this endpoint or in the dashboard under Settings
At runtime, your run() function accesses them via os.environ["SECRET_NAME"]

import os

def run(query: str) -> dict:
    api_key = os.environ["GEMINI_API_KEY"]  # injected by floom
    # ...

Secrets are scoped to the organization. All automations in the same workspace share the same secret store.

Secrets are never exposed in logs, UI, or API responses. They are only available inside the sandbox during execution.

Get Started

Concepts

API Reference

Store a secret

How secrets work

​Store a secret

​How secrets work

Store a secret

How secrets work