Use the `secrets` context in step env.
Section: Permissions and secrets
Expose a secret as an environment variable
yaml
yaml
- name: Login
env:
API_TOKEN: ${{ secrets.API_TOKEN }}
run: ./scripts/login.shExplanation
Secrets are automatically masked in logs, but still avoid printing them.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing Permissions and secrets
Set least-privilege token permissions
Limit the default GITHUB_TOKEN scope.
Grant write access only where needed
Elevate token permissions on a specific job.
Mask a dynamic sensitive value
Hide a generated or fetched secret from logs.
Use protected environments for deploys
Require approval and environment-scoped secrets.
Configure AWS credentials via OIDC
Use the AWS credentials action without long-lived keys.