GitHub Actions: secrets vs vars — when do I use which?

Question

Both are org-level. When should something be a var vs a secret?

Priya Gopal · Accepted Answer

Secrets are masked in logs and can only be read via ${{ secrets.NAME }} — use for tokens, API keys, passwords, anything you would not paste in a PR. Vars are plain text visible to anyone with repo read access — use for non-sensitive config: environment names, feature flags, URLs. When in doubt: secret.

GitHub Actions: secrets vs vars — when do I use which?

1 answer