Secrets

A secret is a named value, such as a site password, an API token or a proxy URL with its credentials, that your requests use without containing it. You store it once in your dashboard; requests point at it with {{secrets.NAME}}, and it's put in place on our side, just before the scrape.

Create a secretCopy Anchor Link

In Dashboard → Secrets, choose Add a secret:

• Name: UPPER_SNAKE_CASE, 64 characters at most, such as SITE_PASSWORD or PROXY_EU.
• Value: any text up to 64 KB.

The value is write-only: you can replace it or delete it, but no screen, endpoint or export ever shows it again.

Use it in a requestCopy Anchor Link

Write {{secrets.NAME}} anywhere in the request body: a header, a cookie, a form value, a proxy URL, a URL.

{
  "target_url": "https://shop.example/login",
  "fields": { "orders": { "selector": ".order", "multiple": true } },
  "options": {
    "browser": true,
    "actions": [
      { "fill": "#email", "value": "[email protected]" },
      { "fill": "#password", "value": "{{secrets.SITE_PASSWORD}}" },
      { "click": "button[type=submit]" }
    ]
  }
}

Your own proxies, with their credentials:

{
  "target_url": "https://example.com",
  "fields": ["h1"],
  "options": { "proxy": { "list": "{{secrets.PROXY_EU}}" } }
}

The value is inserted as text inside the JSON string, escaped, so quotes or backslashes in it are safe. Names are case-sensitive; spaces inside the braces are allowed: {{ secrets.SITE_PASSWORD }}.

A request naming a secret you don't have fails before anything is fetched:

{ "error": { "code": "UNKNOWN_SECRET", "message": "No secret named SITE_PASSWORD: add it in your dashboard." } }

How they're protectedCopy Anchor Link

• Values are encrypted at rest with Supabase Vault (authenticated encryption, the key is kept outside the database tables).
• Only the API decrypts a value, and only for a request of its owner that names it.
• Your request logs keep each request as you sent it, with {{secrets.NAME}} still in place: the value itself is never written to a log. A response can still contain it if the target site echoes it back.
• Deleting a secret, or your account, deletes the encrypted value too.