Protecting tokens and API keys

API keys, personal access tokens, passwords, and similar credentials grant access to external resources. Exposing these credentials creates security risks for your organization. Domino takes extensive measures to ensure that we do not have unauthorized access to your internal data. However, if secrets are mismanaged by users, sensitive data can still be exposed in unintended ways. Follow these guidelines and best practices to use sensitive credentials safely within Domino.

​

Best practices for credential security

• Never hardcode secrets in source code. Do not paste raw tokens or passwords into Python scripts, R files, or Jupyter Notebook cells.
• Keep secrets out of Git history. Hardcoded credentials committed to Git remain in the commit history even after you delete them. Rotate any committed secret in the external service rather than removing it in a later commit. Add configuration files that contain keys to your .gitignore file to help prevent accidental commits.
• Avoid printing secrets to logs. Ensure your scripts do not write raw tokens or environment variables to standard output (stdout), standard error (stderr), or notebook cell outputs, as these can be captured in Domino run logs.

​

Manage credentials in Domino

Domino provides multiple mechanisms to store and pass credentials securely, depending on whether the credential belongs to an individual user, a shared project, a Data Source, or an external vault.

​

User environment variables

Use user environment variables for individual access tokens or keys that follow your user account across every project you run. Scope: Injected securely into all Workspaces, Jobs, and Apps started by your user account. Other users cannot see your user environment variables. To configure user environment variables:

1. Go to Account Settings > User Environment Variables.
2. Enter the name and value of your variable.

​

Project environment variables

Use project environment variables when team members collaborating on a project need shared access to a set of operational credentials. Scope: Accessible to all runs and executions within that specific project. To configure project environment variables:

1. Open your project.
2. Go to Settings > Environment Variables.
3. Add the required keys and values.

​

Git credentials

For authenticating with remote Git repositories, such as GitHub or Bitbucket, do not store Personal Access Tokens or private keys in project files. Manage them through Git credentials instead. Scope: Managed at the account level for authenticating code repositories. To configure Git credentials:

1. Go to Account Settings > Git Credentials.
2. Add SSH keys or Personal Access Tokens.

​

Data Source credentials

When connecting Domino to external data stores such as Snowflake or PostgreSQL, use Data Sources rather than storing database credentials in scripts. Domino stores Data Source credentials in a secret store backed by HashiCorp Vault. Scope: Admin-configured or user-configured secure data connections. To configure Data Source credentials:

1. Go to Account Settings > Data Sources, or open the Data Sources tab in your project.
2. Authenticate using OAuth or stored credentials.

​

External secret managers

If your organization uses external secret management services, integrate them into your Domino workflows:

• External HashiCorp Vault. Domino administrators can configure the platform to connect directly to an enterprise HashiCorp Vault cluster to manage platform environment variables and credentials.
• Cloud secret managers (AWS, Azure, GCP). Query services such as AWS Secrets Manager or Azure Key Vault directly within your Python or R scripts using standard SDKs. Use cluster IAM roles, for example AWS IRSA, for passwordless authentication.

​

Manage your Domino user API key

Your Domino user API key grants programmatic access to the Domino REST API and CLI. See Authenticate with an API key for details. To view your key, go to Account Settings > API Key. To revoke a compromised key:

1. Go to Account Settings > API Key.
2. Click Re-generate API Key. This immediately invalidates the previous key across all external services that use it.

​

Related

• Service Accounts
• Authenticate with an API key
• User environment variables
• Project environment variables
• Git credentials
• Data Source connectors