Secrets and Environment Variables

Secrets and environment variables are named values you save once and reference from any of your JavaScript functions. They keep API keys, credentials, and shared settings out of your code: the code references the name, and ProcessPlan supplies the value at runtime.

They are managed under Administration > Integrations > Environment Variables, on the Secrets / Environment Variables page. The list shows each entry’s Variable Name, Value, Description, Modified By, Modified Date, and Last Used.

Creating a secret or environment variable, or changing one, requires permission to edit account information or permission to edit process templates (see User groups and security groups). The same permissions decide who can change JavaScript functions, which read these values. People with neither permission can still open the list, and every function still gets its variables when an automated action or a drop down field runs it.

Code the AI Assistant runs during a conversation gets your secrets and environment variables only when the person it is talking to has one of those permissions. For anyone else, the code runs without them. An AI Agent action gets only the ones checked under Secrets It May Use in its settings, and only when the person who last changed its instructions has the Edit Process Templates permission. An agent with none checked gets none.

Create a secret or environment variable

1. Click the New Secret icon at the top of the list

2. Enter a Secret / Environment Variable Name. Letters, numbers, and underscores only, for example STRIPE_API_KEY. Names are stored in uppercase

3. Enter the Value

4. For credentials and API keys, check Hide Forever (Secret) - see below

5. Optionally add a Description for Autonomous AI Agent Mode, a detailed note about the variable’s purpose so AI agents understand what it’s for

Secrets are hidden forever

When Hide Forever (Secret) is checked, the value is treated as a secret from then on:

• Anywhere the value is displayed, it appears masked, showing only its last four characters

• You can overwrite a hidden value with a new one at any time, but a hidden value can never be made visible again

• Deleting a secret removes its value for good; there is nothing to restore it from

Caution

Store the original credential somewhere safe (such as your password manager) before saving it as a secret. ProcessPlan will never display it again.

Use a variable in your code

Reference the variable in any JavaScript function as helpers.env.YOUR_VARIABLE_NAME:

async function execute(event, helpers) {
  const response = await helpers.http.get('https://api.example.com/v1/orders', {
    headers: { Authorization: `Bearer ${helpers.env.STRIPE_API_KEY}` },
  });
  return response;
}

Variables referenced in your code are detected automatically and injected when the function runs; there is nothing to configure on the function itself. The Last Used column shows the most recent day the variable was read by a function an automated action or a drop down field ran, or by code the AI Assistant or an AI agent ran. It is recorded once a day, and clicking Run Test on a function does not count.