Secrets and variables

Bundles declare configuration names; Aleph stores their values separately. This keeps a public or cloned bundle useful without exposing credentials or environment-specific settings.

Declare mappings#

[runtime.env]
GITHUB_TOKEN = "{{secrets.GITHUB_TOKEN}}"
REPOSITORY = "{{vars.REPOSITORY}}"

Use secrets for sensitive values and variables for non-secret runtime configuration. Only {{secrets.NAME}} and {{vars.NAME}} are accepted.

Exact-scope resolution#

Aleph never falls back between these scopes. A value with the same name in your personal Vault cannot satisfy a team agent.

Cloning and readiness#

Clones copy references, not values. After cloning, use missingSecrets and missingVariables as the setup checklist for the destination scope.

Channel credentials are also stored as scoped Vault entries, but Aleph creates and manages their generated names through the Channels UI. Platform model access is managed by Aleph; users do not supply an LLM key.

Never put a real secret in Markdown, TOML, a skill, or a conversation.