Using secrets in Request Fields

After you fetch Google Cloud secrets into an environment, reference them the same way as other external secrets in headers, query params, body, and auth fields.

Syntax is {{<row-name>.<secret-id>}} (for example, {{staging.api-key}}).

Variable syntax

For GCP, each environment row Name is the namespace. Under it, Bruno nests every secret ID from that project.

Recommended syntax (v4+):

{{<row-name>.<secret-id>}}

If the secret payload is JSON, access a field with a sub-key:

{{<row-name>.<secret-id>.<json-key>}}

Examples

Stored in GCP	Bruno row Name	Reference
Secret ID api-key with a plain string value	staging	{{staging.api-key}}
Secret ID db with JSON { "password": "…" }	staging	{{staging.db.password}}

For example, with a row named db_pass and a GCP secret ID gcp-sandbox-key-1, use {{db_pass.gcp-sandbox-key-1}} in the request body:

Legacy syntax (deprecated):

{{$secrets.<row-name>.<secret-id>}}

Using secrets in scripts

Access secrets from Pre-request and Post-request scripts with bru.getSecretVar():

const apiKey = bru.getSecretVar('staging.api-key');
req.setHeader('Authorization', 'Bearer ' + apiKey);

// JSON secret sub-key
const password = bru.getSecretVar('staging.db.password');

Make sure the GCP Secrets Manager account is configured and secrets are fetched before using them in scripts. Names must match the environment row alias and GCP secret IDs exactly.

Using secrets with Bruno CLI

To learn more about using secrets with Bruno CLI, see the CLI Secret Managers documentation.