Secrets

Enneo offers a central storage for secrets — such as API tokens, client secrets or basic auth credentials — that can be referenced in the headers of API call executors via placeholders. Values are masked in the interface and are never output in API responses.

Secrets are mainly used for direct API call execution (type apiCall), so that authentication headers can be set without storing the actual token value in the executor definition.

Managing Secrets

Secrets are managed in the settings under Integration of the subsystems → Secrets. Each entry consists of:

• Key — the name of the secret, such as MY_API_TOKEN. This name is referenced in the placeholder.
• Value — the actual value. It is masked in the interface and not included in API responses.

Any number of secrets can be stored.

Using Secrets in API Call Executors

In the header values of an API call executor, secrets can be referenced using the placeholder {{secret.KEY}}. When executing the executor, enneo replaces the placeholder with the stored value.

Example header of an API call executor:

{
  "Authorization": "Bearer {{secret.MY_API_TOKEN}}",
  "X-Api-Key": "{{secret.PARTNER_API_KEY}}",
  "Accept": "application/json"
}

If a secret with the specified key does not exist, the placeholder remains in the header value — so the call will typically fail with an authentication error rather than proceeding with an empty token.

Secrets in the SDK (Sandbox Executors Type code)

For sandbox executors, the SDK provides the method ApiEnneo.getSecret(key). It returns the stored value of the secret or null/None if the key is not configured. That way, secrets can be used without having to store them in the code.

token = ApiEnneo.getSecret('MY_API_TOKEN')
if not token:
    raise RuntimeError('MY_API_TOKEN is not configured')

headers = {
    'Authorization': f'Bearer {token}',
    'Accept': 'application/json',
}
response = Api.call('GET', 'https://my-api.example.com/v1/orders', headers)

const token = await ApiEnneo.getSecret('MY_API_TOKEN');
if (!token) {
  throw new Error('MY_API_TOKEN is not configured');
}

const headers = {
  Authorization: `Bearer ${token}`,
  Accept: 'application/json',
};
const response = await Api.call('GET', 'https://my-api.example.com/v1/orders', headers);

$token = ApiEnneo::getSecret('MY_API_TOKEN');
if ($token === null) {
    throw new RuntimeException('MY_API_TOKEN is not configured');
}

$headers = [
    'Authorization' => 'Bearer ' . $token,
    'Accept'        => 'application/json',
];
$response = Api::call('GET', 'https://my-api.example.com/v1/orders', $headers);

Permissions

Reading and writing the executorSecrets setting requires the updateAiAgent permission. Values are masked in the interface and not output in read endpoints.