Skip to main content
Secret Manager lets you securely and centrally store, manage, and inject secrets, which are sensitive strings such as access tokens, bearer tokens, API keys, or passwords. Weights & Biases features can read team secret values, which removes the need to paste them or store them in code, training scripts, or plain-text automation configuration. This page is for Weights & Biases Admins who need to create, rotate, delete, or manage access to team secrets used by webhook automations, Weave Playground, and sandboxes. Secrets live in each team’s Secret Manager, in the Team secrets section of the team settings.
  • Only Weights & Biases Admins can create, edit, or delete a secret.
  • Secrets are available by default on Multi-tenant Cloud. On W&B Server deployments that you host in Azure, Google Cloud, or AWS, the Team secrets section appears only when the deployment enables the secret store (ENABLE_SECRET_STORE). Connect with your Weights & Biases account team to discuss how you can use secrets in Weights & Biases if you use a different deployment type.
  • In W&B Server, you are responsible for configuring security measures that satisfy your security needs.
    • Weights & Biases strongly recommends that you store secrets in a Weights & Biases instance of a cloud provider’s secrets manager from AWS, Google Cloud, or Azure, which include advanced security capabilities.
    • Weights & Biases recommends against using a Kubernetes cluster as the backend of your secrets store. Use a cluster only if you can’t use a Weights & Biases instance of a cloud secrets manager (AWS, Google Cloud, or Azure) and you understand how to prevent the security vulnerabilities that can occur.

​
Where team secrets are used

You can use team secrets in Weights & Biases in multiple contexts. After you add a secret, a feature like W&B Automations can access the secret by name.
  • Webhook automations: When an automation sends an HTTP request to a webhook, you can attach team secrets for authentication headers and for values referenced in the payload. You can scope automations to a project or a Registry. Registry-scoped automations that call a webhook use the same team webhooks and team secrets as project-scoped webhook automations.
  • Weave Playground: Supply provider credentials as named team secrets. See Add provider credentials and information.
  • Sandboxes: Securely provide team secrets to your sandboxes to make them available as environment variables. See Secrets in sandboxes.

​
Add a secret

Add a secret when you want to make a sensitive value available to Weights & Biases features without exposing it in code or configuration. After you complete these steps, the secret is available by name to the team features described in Where team secrets are used. To add a secret:
  1. If an external service gives you a token or API key, obtain that value through that service’s normal flow. If necessary, save the sensitive string securely, such as in a password manager, before you paste it into Secret Manager. Saving a backup matters because, after creation, Weights & Biases no longer reveals the secret’s value.
  2. Sign in to Forge and go to the team’s Settings page.
  3. In the Team secrets section, click New secret.
  4. Provide a name for the secret, using letters, numbers, and underscores (_). The name must start with a letter or an underscore.
  5. Paste the sensitive string into the Value field.
  6. Click Add secret.
When you configure a webhook for an automation, select which team secrets the webhook may use. For field names, access tokens, and payload variables, see Create a webhook automation.
After you create a secret, you can access that secret in a webhook automation’s payload using the format ${SECRET_NAME}.

​
Rotate a secret

Rotate a secret when its value changes (for example, when an upstream credential is regenerated or when you suspect the existing value has been compromised). Because Weights & Biases doesn’t reveal a secret’s current value after creation, rotation is also the way to replace a value you no longer have a copy of. To rotate a secret and update its value:
  1. Click the pencil icon in the secret’s row to open the secret’s details.
  2. Set New value to the new value. Optionally, click Reveal secret value to verify the new value.
  3. Click Replace secret. The secret’s value updates and no longer resolves to the previous value.
After a secret is created or updated, you can no longer reveal its current value. Instead, rotate the secret to a new value.
Rotating or replacing a secret can affect every feature that still expects the old value. Before you rely on the new value everywhere, update webhook automations, sandboxes that inject the secret, Weave Playground, or other consumers.

​
Delete a secret

Delete a secret when no team feature uses it. Because deletion is immediate and permanent, confirm that no automations, sandboxes, or other consumers still reference the secret before you proceed (see Manage access to secrets). To delete a secret:
  1. Click the trash icon in the secret’s row.
  2. Read the confirmation dialog, then click Delete. The secret is deleted immediately and permanently.

​
Manage access to secrets

You can reference a team’s secrets by name in webhook automations, Weave Playground, sandboxes, and other team-scoped features that select secrets by name. Before you remove a secret, update or remove every automation, sandbox configuration, or Playground flow that uses it so they don’t stop working.
Last modified on September 30, 2026