Using secrets in Request Fields

After you fetch Google Cloud secrets into an environment, reference them the same way as other external secrets in headers, query params, body, and auth fields.

Syntax is {{<row-name>.<secret-id>}} (for example, {{staging.api-key}}).

Variable syntax

For GCP, each environment row Name is the namespace. Under it, Bruno nests every secret ID from that project. Recommended syntax (v4+):

{{<row-name>.<secret-id>}}

If the secret payload is JSON, access a field with a sub-key:

{{<row-name>.<secret-id>.<json-key>}}

Examples

Stored in GCP	Bruno row Name	Reference
Secret ID `api-key` with a plain string value	`staging`	`{{staging.api-key}}`
Secret ID `db` with JSON `{ "password": "…" }`	`staging`	`{{staging.db.password}}`

For example, with a row named db_pass and a GCP secret ID gcp-sandbox-key-1, use {{db_pass.gcp-sandbox-key-1}} in the request body: Legacy syntax (deprecated):

{{$secrets.<row-name>.<secret-id>}}

Using secrets in scripts

Access secrets from Pre-request and Post-request scripts with bru.getSecretVar():

const apiKey = bru.getSecretVar('staging.api-key');
req.setHeader('Authorization', 'Bearer ' + apiKey);

// JSON secret sub-key
const password = bru.getSecretVar('staging.db.password');

Make sure the GCP Secrets Manager account is configured and secrets are fetched before using them in scripts. Names must match the environment row alias and GCP secret IDs exactly.

Using secrets with Bruno CLI

To learn more about using secrets with Bruno CLI, see the CLI Secret Managers documentation.

API Client

Send Requests

Variables

Authentication

Secret Management

Tests

Scripts

Git & Collaboration

AI

Apps

Settings

Debugging

Using secrets in Request Fields

Variable syntax

Using secrets in scripts

Using secrets with Bruno CLI

​Variable syntax

​Using secrets in scripts

​Using secrets with Bruno CLI

Variable syntax

Using secrets in scripts

Using secrets with Bruno CLI