> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/internal-developer-portal/3.0/troubleshooting-and-resources/idp-tutorials/using-secret-as-an-input.md).

# Using a short-lived secret to trigger a service onboarding pipeline

Sometimes, as a platform engineer, you might want your developers to enter their credentials when using a Workflow in IDP. This is useful when, for example, you want to use developers' GitHub credentials in a pipeline and create a repository on their behalf. This is a good approach because it ensures that developers create repositories that they can access and that you do not have to provide a superuser token for such tasks. This tutorial explains how you can configure such a workflow and the corresponding pipeline.

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* Make sure that you have created a [basic service onboarding pipeline](/internal-developer-portal/troubleshooting-and-resources/idp-tutorials/service-onboarding-pipeline.md).
* All account users who want to trigger pipelines and create secrets should have access to the project that contains the service onboarding pipeline.

### Pipeline changes <a href="#pipeline-changes" id="pipeline-changes"></a>

In your Harness pipeline, create a variable. Set its type to **Secret** and its value to **Runtime input**, as shown in the following figure:

![](/files/7T2s8XPmpSC74V6luJsi)

### Workflow changes <a href="#workflow-changes" id="workflow-changes"></a>

Use the following workflow to update the `workflow.yaml` file that you registered with IDP. The sections that follow include detailed instructions for each of these steps:

1. Receive a secret input through the UI.
2. Create a Harness secret by using an action.
3. Use the secret ID to trigger the Harness pipeline.
4. Delete the secret after the pipeline is triggered.

#### 1. Create an input field in the workflow <a href="#id-1-create-an-input-field-in-the-workflow" id="id-1-create-an-input-field-in-the-workflow"></a>

Inside the `spec.parameters[0].properties` field of your `workflow.yaml` file, add the following property. This property generates the input field in which users can enter their credentials:

```yaml
spec:
  parameters:
    - title: Details
      properties:
        secretValue:
          title: Your credentials
          type: string
          ui:widget: password
```

![](/files/hW7Lzq7ceYK4HeEB6JIW)

#### 2. Add a step to create the secret <a href="#id-2-add-a-step-to-create-the-secret" id="id-2-add-a-step-to-create-the-secret"></a>

Use the `harness:create-secret` action in a step in the `workflow.yaml` file to create a Harness secret from the developer's input. The following step creates a secret in the specified project, so make sure that the project contains the service onboarding pipeline in which you plan to reference the secret:

```yaml
spec:
  # ...
  steps:
    - id: createsecret
      name: Create Harness secret
      action: harness:create-secret
      input:
        projectId: "<your-harness-project-id>"
        orgId: "<your-harness-org-id>"
        secretValue: ${{ parameters.secretValue }}
        apikey: ${{ parameters.token }}
```

The output of this action includes a field named `secretId`. This field stores the generated secret's ID. You will use the secret ID in subsequent steps.

#### 3. Use the secret as a runtime input in the pipeline <a href="#id-3-use-the-secret-as-a-runtime-input-in-the-pipeline" id="id-3-use-the-secret-as-a-runtime-input-in-the-pipeline"></a>

Use the `steps.createsecret.output.secretId` action to supply the secret ID as an input to the service onboarding pipeline that you want to trigger:

```yaml
spec:
  # ...
  steps:
    # - id: createsecret
    # ...
    - id: trigger
      name: Creating your new service
      action: trigger:harness-custom-pipeline
      input:
        url: "<link-to-your-Harness-pipeline>"
        inputset:
          input1: ${{ parameters.input1 }}
          # ...
          secret: ${{ steps.createsecret.output.secretId }}
        apikey: ${{ parameters.token }}
```

#### 4. Delete secret after the job is done <a href="#id-4-delete-secret-after-the-job-is-done" id="id-4-delete-secret-after-the-job-is-done"></a>

Use the `harness:delete-secret` action to remove the secret from the project as you will no longer need it.

```yaml
spec:
  # ...
  steps:
    # - id: createsecret
    # ...
    # - id: trigger
    # ...
    - id: deletesecret
      name: Delete the Harness secret
      action: harness:delete-secret
      input:
        projectId: "your-harness-project-id"
        orgId: "your-harness-org-id"
        secretId: ${{ steps.createsecret.output.secretId }}
        apikey: ${{ parameters.token }}
```

{% hint style="info" %}
If the pipeline step fails, the secret is not removed from the project. We are exploring various approaches for automatic cleanup. Until this issue is resolved, identify the secrets that this action creates and then delete them manually. These secrets are of the form `idp_template_tempsecret_{uniqueID}`.
{% endhint %}