Skip to content

Using secrets in Request Fields

Secrets are accessed in the same way as collection and environment variables in headers, query params, body, and auth fields.

v4 syntax change: - The recommended syntax is now {{secret-name.key-name}} (e.g. {{dbCredentials.username}}).

  • The old {{$secrets.secret-name.key-name}} syntax still works in v4 but is deprecated and it is shown with an underline in the editor and will be removed in the next major release.

Recommended syntax (v4+):

{{<secret-name>.<key-name>}}

For example, if you have a secret named dbCredentials with a key username, reference it as {{dbCredentials.username}}.

Legacy syntax (deprecated):

{{$secrets.<secret-name>.<key-name>}}

For example: {{$secrets.dbCredentials.password}}

Using Secrets in Scripts

You can also access secrets from within Pre-request and Post-request scripts using the bru.getSecretVar() function.

const secretValue = bru.getSecretVar('<secret-name>.<key-name>');
console.log(secretValue); // This will log the value of your secret

// Example: Using Azure Key Vault secrets in authentication
const apiKey = bru.getSecretVar('azure-secrets.api-key');
req.setHeader('Authorization', 'Bearer ' + apiKey);

Make sure your Azure Key Vault secret provider is properly configured and the secrets are fetched before using them in scripts. Verify that the secret names and key names match exactly with your Azure Key Vault configuration.

Using Secrets with Bruno CLI

To learn more about using secrets with Bruno CLI, please refer to CLI Documentation.