---
title: "Secrets Management"
description: "Store sensitive values in StackHawk and use them in HawkScan configurations without exposing credentials"
url: https://docs.stackhawk.com/platform/user-secrets/
---

# Secrets Management

The [Secrets Manager](https://app.stackhawk.com/settings/secrets) lets you store sensitive values—like API tokens and passwords—that HawkScan can use at runtime without exposing them as environment variables on your scanner host.

Secrets work just like environment variables when interpolated in your HawkScan configuration. Any defined secrets are automatically applied during scans and redacted in logs.

> **Note:** Stored secrets are unique per user account, and are **not** shared among members of an organization. To share a credential with your whole team, use an [organization secret](https://docs.stackhawk.com/platform/organization-secrets/) instead.

## Creating a Secret

Navigate to **Settings → Secrets** to create a new secret:

1. Click **Add Secret**
2. Enter a name using environment variable convention (e.g., `MY_API_TOKEN`)
3. Enter the secret value
4. Click **Save**

Use a name you wouldn’t normally find in your scan environment variables so secrets are easier to track.

> **Warning:** A secret’s value is never displayed in the platform UI after it is saved — the Secrets Manager shows only names and metadata. It is **not** write-only, though: the value is returned by the API to anyone authenticating as you, which is how HawkScan resolves it during a scan. Treat an API key for your account as equivalent to the secrets it can read.
>
> You can always update or delete a secret.

## Using Secrets

Secrets are automatically applied when the authenticating user has defined them. They work as environment variable overrides when interpolating your HawkScan configuration, and are redacted in scan logs.

When running the `hawk` CLI, use `--env/-e` or `--env-file` to supply variable values. See [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/extended-configuration/#environment-variable-runtime-overrides) for details.

For example, if your `stackhawk.yml` contains:

```yaml
app:
  host: ${APP_HOST:http://localhost:3000}
```

Running with `-e APP_HOST=http://dev.example.com` sets the host to that value:

```bash
hawk scan -e APP_HOST=http://dev.example.com
```

This works similarly to Docker’s `-e` flag.

## Organization Secrets

A user secret resolves only for scans **you** run. For a credential the whole team scans with, use an [organization secret](https://docs.stackhawk.com/platform/organization-secrets/) — stored once at the organization level and resolvable by any scan run under it. Where both exist with the same name, the user secret wins.