Manage and use secrets

Before you start

See Team roles and permissions to understand who can create and use secrets.

Navigate to the secrets page

Secret scope determines how to access them:

• Personal secrets — click the menu next to your username, then select Personal Secrets from the left menu.
• Team secrets — open the team's page, then select Secrets from the left menu.
• Global secrets — open the global administration page, then select Global secrets from the left menu.

Creation, editing and deleting secrets works the same for all secret scopes and is described below.

Create a secret

1. Navigate to the secrets page.
2. Click + New Secret.
3. Enter a unique name and an optional description.
4. Select a secret type and authentication type.
5. Fill in the type-specific fields. See Secret types.
6. Click Create.

The secret appears in the secrets table.

Edit a secret

1. Navigate to the secrets page.
2. Click the three-dot menu on the secret row.
3. Select Edit.
4. Update the values and click Save changes.

The secret type and authentication type cannot be changed after creation. To change them, delete the secret and create a new one.

Delete a secret

Irreversible operation

All the workflows that are using the secret will fail. This cannot be undone.

1. Navigate to the secrets page.
2. Click the three-dot menu on the secret row.
3. Select Delete.
4. Type the secret name to confirm, then click Delete permanently.

Interactive login to an OAuth secret

Some secret types require an interactive login to obtain an access token. Secrets that need login show Not consumable in the status column until you authenticate.

1. Click the three-dot menu on the secret row.
2. Select Login.
3. Complete the login in the browser window that opens.

The secret becomes consumable after a successful login.

Manage access to a team or global secret

1. Click the three-dot menu on the secret row.
2. Select Manage access.
3. Type the name of the user or the team to share with.
4. Choose an access level: can use or can edit.
5. Click Apply.

Secrets shared with a user appear in the user's personal secrets list. Secrets shared with a team appear in the team secrets list.

WARNING

Personal secrets cannot be shared. To share secrets with other users or teams, create a team or a global secret.

Use a secret in a workflow

1. Add a Secrets Retriever node to the workflow.
2. Open the Secrets Retriever configuration dialog and select the secrets you need.
3. Connect the node's output ports to downstream nodes.

For service-specific secret types, the Secrets Retriever's output port replaces the platform's own Authenticator node — you don't add a Google Authenticator or Microsoft Authenticator separately.

INFO

You can retrieve secrets from another Hub with a KNIME Authenticator node connected to the Secrets Retriever's dynamic input port.

Secrets in deployments

When a workflow needs to access a team secret, deploy it with default team scope execution. The app runs as the team and accesses team secrets without requiring each viewer to have individual access.

To use the executing user's own credentials instead, deploy with user scope execution. In a data app, you can use the Knime Hub Secret Selector component to let the user select one of the secrets they have access to during data app execution. Alternatively, you can use the Credentials Widget. This allows the user to enter their own credentials that should be used during execution.

Select a secret dynamically with a flow variable

By default, you select a secret manually in the Secrets Retriever node dialog. The name shown in the picker, for example a space name followed by the secret name, is a display label and cannot be used directly in a flow variable.

To find the underlying identifier for a secret:

1. Add the Secrets Retriever node and manually select the secret.
2. Click on the Flow Variables button and set Output as flow variable for the secret selection. Name it, for example, output-secret-id.
3. Execute the node and inspect the value of that flow variable. It has the format secret:<uuid>!<type>, for example secret:f130dcce-a566-4684-b821-33a024c8bd92!credentials.

To select a secret dynamically, pass this identifier into a string flow variable and use it to override the secret selection control in the Flow Variables button.

Keep the following in mind:

• The identifier is tied to one specific secret. It is not portable between users or instances just because two secrets share the same display name.

• Knowing a secret's identifier does not grant access to it. The user or team executing the workflow still needs Use or Edit rights on the secret, see Manage access to a team or global secret.

• To select a user's secret from a data app, see Secrets in deployments.

Audit

Access to secrets is logged. Admins can review creation, edits, and usage through the audit log — see Audit trails.