{"meta":{"title":"Understanding GitHub secret types","intro":"Learn about the usage, scope, and access permissions for GitHub secrets.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/reference","title":"Reference"},{"href":"/en/code-security/reference/secret-security","title":"Secret security"},{"href":"/en/code-security/reference/secret-security/secret-types","title":"Secret types"}],"documentType":"article"},"body":"# Understanding GitHub secret types\n\nLearn about the usage, scope, and access permissions for GitHub secrets.\n\n## How GitHub stores secrets\n\nGitHub uses [Libsodium sealed boxes](https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes) to encrypt secrets. A secret is encrypted before reaching GitHub and remains encrypted until it's used by Dependabot, GitHub Actions, or Codespaces.\n\n## Dependabot secrets\n\nDependabot secrets are used to store credentials and sensitive information for use within Dependabot.\n\nDependabot secrets are referenced in a repository's `dependabot.yml` file.\n\n### Usage\n\nDependabot secrets are typically used by Dependabot to authenticate to private package registries. This allows Dependabot to open pull requests to update vulnerable or outdated dependencies in private repositories. Used for authentication, these Dependabot secrets are referenced in a repository's `dependabot.yml` file.\n\nDependabot secrets can also include secrets required for workflows initiated by Dependabot. For example, Dependabot can trigger GitHub Actions workflows when it creates pull requests to update dependencies, or comments on pull requests. In this case, Dependabot secrets can be referenced from workflow files (`.github/workflows/*.yml`) as long as the workflow is triggered by a Dependabot event.\n\n### Scope\n\nYou can define Dependabot secrets at:\n\n* Repository level\n* Organization level\n\nDependabot secrets can be shared across repositories when set at the organization-level. You must specify which repositories in the organization can access the secret.\n\n### Access permissions\n\nDependabot secrets are accessed by Dependabot when authenticating to private registries to update dependencies.\n\nDependabot secrets are accessed by GitHub Actions workflows when the trigger event for the workflow is initiated by Dependabot. This is because when a workflow is initiated by Dependabot, only Dependabot secrets are available - Actions secrets are not accessible. Therefore, any secrets required for these workflows must be stored as Dependabot secrets, rather than Actions secrets. There are additional security restrictions for the `pull_request_target` event. See [Limitations and restrictions](#limitations-and-restrictions).\n\n#### User access permissions\n\nRepository-level secrets:\n\n* Users with **admin access** to the repository can create and manage Dependabot secrets.\n* Users with **collaborator access** to the repository can use the secret for Dependabot.\n\nOrganization-level secrets:\n\n* **Organization owners** can create and manage Dependabot secrets.\n* Users with **collaborator access** to the repositories with access to each secret can use the secret for Dependabot.\n\n### Limitations and restrictions\n\nFor workflows initiated by Dependabot, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by Dependabot (`github.event.pull_request.user.login == 'dependabot[bot]'`):\n\n* The workflow receives a read-only `GITHUB_TOKEN`.\n* Secrets are **not** available to the workflow.\n\nThis extra restriction helps prevent potential security risks that could arise from pull requests created by Dependabot.\n\nDependabot secrets are not passed to forks.\n\n## Actions secrets\n\nActions secrets are used to store sensitive information such as API keys, authentication tokens, and other credentials in workflows.\n\n### Usage\n\nActions secrets are referenced in workflow files (`.github/workflows/*.yml`).\n\n### Scope\n\nYou can define Actions secrets at:\n\n* Repository level\n* Environment level\n* Organization level\n\nEnvironment-level secrets are specific to a particular environment, such as production or staging.\nActions secrets can be shared across repositories if set at the organization-level. You can use access policies to control which repositories have access to the secret.\n\n### Access permissions\n\nActions secrets are only available within GitHub Actions workflows. Despite running on Actions, Dependabot does not have access to Actions secrets.\n\nFor workflows initiated by Dependabot, Actions secrets are not available. These workflow secrets must be stored as Dependabot secrets in order to be accessible to the workflow.\n\nThe location where you store the Actions secret determines its accessibility:\n\n* Repository secret: all workflows in the repository can access the secret.\n* Environment secret: secret is limited to jobs referencing that particular environment.\n* Organization secret: all workflows in the repositories that have been granted access by the organization can access the organization secrets.\n\n#### User access permissions\n\nRepository-level and environment secrets:\n\n* Users with **admin access** to the repository can create and manage Actions secrets.\n* Users with **collaborator access** to the repository can use the secret.\n\nOrganization-level secrets:\n\n* **Organization owners** can create and manage Actions secrets.\n* Users with **collaborator access** to the repositories with access to each secret can use the secret.\n\n### Limitations and restrictions\n\n* Actions secrets are not available to workflows initiated by Dependabot.\n* Actions secrets are not passed to workflows that are triggered by a pull request from a fork.\n* GitHub Actions automatically redacts the contents of all GitHub secrets that are printed to workflow logs.\n* You can store up to 1,000 organization secrets, 100 repository secrets, and 100 environment secrets. Secrets are limited to 48 KB in size. For more information, see [Limits for secrets](/en/actions/reference/security/secrets#limits-for-secrets).\n\n## Codespaces secrets\n\nCodespaces secrets store credentials and sensitive information, such as API tokens and SSH keys, for use within GitHub Codespaces, allowing you to configure secure development environments.\n\n### Usage\n\nCodespaces secrets are referenced within the Codespaces development container configuration (`devcontainer.json`).\n\n### Scope\n\nYou can define Codespaces secrets at:\n\n* User account level\n* Repository level\n* Organization level\n\nFor user account level secrets, you can choose which repositories have access to the secret.\nCodespaces secrets can be shared across repositories if set at the organization-level. You can use access policies to control which repositories have access to the secret.\n\n### Access permissions\n\nCodespaces secrets are only accessible in Codespaces.\n\nGitHub Actions cannot access Codespaces secrets.\n\n#### User access permissions\n\nUser account-level secrets:\n\n* Codespaces secrets are available to any codespace you create using repositories with access to that secret.\n\nRepository-level secrets:\n\n* Users with **admin access** to the repository can create and manage Codespaces secrets.\n* Users with **collaborator access** to the repository can use the secret.\n\nOrganization-level secrets:\n\n* **Organization owners** can create and manage Codespaces secrets.\n* Users with **collaborator access** to the repositories with access to each secret can use the secret.\n\n### Limitations and restrictions\n\n* You can store up to 100 secrets for GitHub Codespaces.\n* Secrets are limited to 48 KB in size.\n* Codespaces secrets are not passed to forks.\n\n## Further reading\n\n* [Configuring access to private registries for Dependabot](/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#storing-credentials-for-dependabot-to-use)\n* [Secrets reference](/en/actions/reference/security/secrets#limits-for-secrets)\n* [Managing development environment secrets for your repository or organization](/en/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization)\n* [Managing your account-specific secrets for GitHub Codespaces](/en/codespaces/managing-your-codespaces/managing-your-account-specific-secrets-for-github-codespaces)"}