Guides

Secrets Management

Securely inject secrets into workflows without storing them in version control or exposing them in logs.

Secret providers

CliFi integrates with multiple secret backends. Configure the provider in your clifi.yaml or environment file, then reference secrets with the ${{ secrets.NAME }} syntax.

Environment variables

For local development and simple CI pipelines, secrets can be read from environment variables. Prefix the variable name with CLIFI_SECRET_ to automatically expose it in workflows.

bash

export CLIFI_SECRET_API_KEY=sk-live-...

1Password

Use the 1Password CLI integration to fetch secrets directly from vaults. This requires the 1Password CLI to be installed and authenticated.

clifi.yaml

secrets:
  provider: 1password
  vault: Engineering
  items:
    API_KEY: api-key-credential
    DATABASE_URL: database-connection-string

HashiCorp Vault

For enterprise deployments, connect to Vault using AppRole or Kubernetes authentication. CliFi handles token renewal and lease management automatically.

Secret masking

CliFi automatically masks secret values in log output, environment dumps, and error messages. If a secret leaks, the workflow aborts and the run is flagged for review.