Store Webhook Credentials Securely

The Custom Webhook action masks secret keys for Basic auth, Bearer token, and API key authentication. Instead of pasting a secret into every action, you save it once under a name and select it from a dropdown. The value is never shown again in plain text.

What this protects you from

• Accidentally exposing a key when sharing your screen or a workflow.
• Teammates copying a secret they have no need to see.
• Having to hunt through many workflows to change a key.

Add a credential

1. Open a workflow and add or edit a Custom Webhook action.
2. Set Authorization to Basic auth, Bearer token, or API key.
3. Open the key dropdown and choose Create New Key.
4. Give it a recognizable name and enter the secret.
5. Save the key, then save the action.

For later webhooks, simply pick the key by its name.

Who can do what

• Keys are available only in the account where they were created.
• Only an administrator or the person who created a key can edit or delete it.
• Anyone building a workflow can select an existing key by name without seeing its value.

Good habits

• Name keys after the service, such as "Shipping API - live."
• Create separate keys for test and production.
• Replace a key promptly if you think it has leaked, then update the saved entry.

Good to know: Deleting a key breaks any webhook that still uses it, so reassign those actions to a new key first.