How to add a repository secret for Actions in GitHub
Open the repository's Settings, then Secrets and variables, then Actions, and click New repository secret. Enter a name and the value, click Add secret, and read it in a workflow as secrets.NAME.
This is for a developer whose workflow, often one a coding agent wrote, needs an API key or deploy token that must not sit in the code. A repository secret is encrypted, never shown again after you save it, and handed to workflows that ask for it by name. GitHub also has environment and organisation secrets; this guide covers the repository level and says when to pick another.
Before you start
You need admin access to the repository (or to be its owner). For an organisation repository, an organisation owner may need to allow it.
- Time
- About 2 minutes
- Account
- Not walked yet
| Role | What it can do here |
|---|---|
| Repository admin or owner | Can see the Settings tab and create, update and delete repository secrets. |
| Write access | Can run workflows that use secrets but cannot see the Settings tab or manage secrets. |
-
1
Open the repository's Settings
Go to the repository on GitHub and click the Settings tab at the right of the tab bar.
You should see: The repository's General settings with a left menu.
-
2
Open Secrets and variables
In the left menu under Security, click Secrets and variables, then Actions.
You should see: A page called Actions secrets and variables with Secrets and Variables tabs.
-
3
Click New repository secret
On the Secrets tab, click New repository secret.
You should see: A form with Name and Secret fields.
-
4
Enter the name and value
Enter a Name such as API_KEY and paste the value into Secret. Do not wrap it in quotes.
You should see: Both fields filled, and the Add secret button active.
-
5
Click Add secret
Click Add secret. GitHub may ask you to confirm with your password or a passkey.
You should see: The secret listed under Repository secrets with its name and when it was updated, but not its value.
-
6
Use it in a workflow
In your workflow file, pass it in as secrets.API_KEY inside an expression, for example as an env value on the step that needs it, and run the workflow.
You should see: The workflow run uses the value, and the log shows three asterisks where it would appear.
If it does not work
There is no Settings tab on the repository. You do not have admin access. Ask a repository admin or owner to add the secret, or to raise your role.
The workflow sees an empty value. The name in the workflow does not match exactly, the secret is an environment secret and the job does not name that environment, or the run came from a fork.
Name is invalid when you click Add secret. Use only letters, numbers and underscores, and do not start with GITHUB_ or a digit.
The organisation secret does not reach this repository. An organisation secret has a repository access policy. An organisation owner must add this repository to it, and private repositories on a free plan may not be eligible.
Questions
What is the difference between a repository, environment and organisation secret?
A repository secret is available to every workflow in that repository. An environment secret is only given to jobs that name the environment, which can require an approval first, so use it for production deploy keys. An organisation secret is shared across chosen repositories.
How do I use the secret in a workflow?
Refer to it as secrets.NAME inside an expression, for example env with API_KEY set to the expression secrets.API_KEY. GitHub masks the value in logs.
Can I see a secret's value after saving it?
No. GitHub never shows it again. You can only update it with a new value or remove it.
Why is the secret empty in a pull request from a fork?
Secrets are not passed to workflows triggered by pull requests from forks, apart from GITHUB_TOKEN. This protects them from untrusted code.
Are there rules for secret names?
Letters, numbers and underscores only, no spaces, and the name cannot start with GITHUB_ or a number. Names are saved in upper case.
How we checked
Verified 11 Oct 2026 against the live interface on not walked yet.
Related guides
Ready to do it?
Run these 6 steps on your own GitHub page. Each step shows in a panel on the page, Next when you are ready.