I would like to create a GitHub workflow for running tests against a REST API. The API needs a key that is always tied to a user, there is no global "testing" key.

Is there a way for each contributor to store their API key in a way that GitHub Actions can access it? I understand there is GitHub Secrets, but these are at best defined at a repo-level. I have also seen that this option exists for Codespaces, but my organization is not using those.

1 Answer 1


I haven't seen this, since the GHA only has the person who triggered and commits context available.

For testing, it's better to have a user assigned to this purposes and then store its secrets in the repo/org level. Although if the REST API is the project itself, setting up the project (API), creating the test user (with pre-defined secrets) and testing with it should be part of the pipeline as possible.

As a last resource (wouldn't recommend, reconsider strategy), I'd go ahead and use a separate vault for secrets (like Hashicorp Vault), login with project credentials and based on an input or action actor, fetch per-user secrets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.