# \[FeatureRequest\] Native Secret Manager / Secure Variables for HomeyScript and Advanced Flows

**URL:** <https://community.homey.app/t/featurerequest-native-secret-manager-secure-variables-for-homeyscript-and-advanced-flows/160706>\
**Category:** Ideas & Suggestions\
**Tags:** featurerequest, advancedflow\
**Created:** [October 11, 2026, 9:55pm UTC](https://community.homey.app/t/featurerequest-native-secret-manager-secure-variables-for-homeyscript-and-advanced-flows/160706 "2026-10-11T21:55:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lisoro](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/lisoro/32/79513_2.png) [@Lisoro](https://community.homey.app/u/Lisoro)\
**Post date:** [October 11, 2026, 9:55pm UTC](https://community.homey.app/t/featurerequest-native-secret-manager-secure-variables-for-homeyscript-and-advanced-flows/160706/1 "2026-10-11T21:55:36Z")

</div>

Hi Homey team and community,

I’d like to suggest adding a **native Secret Manager** to Homey Pro for securely storing and managing sensitive information such as API keys, access tokens, refresh tokens, passwords, and other credentials.

**The problem**

HomeyScript and Advanced Flows make Homey an incredibly powerful automation platform, especially when integrating external APIs and services.

However, there doesn’t seem to be a dedicated, secure way to manage sensitive credentials that can be accessed by scripts and automations.

Currently, users often have to store credentials directly in script source code or use regular Homey Logic variables. Neither approach provides a proper solution for managing secrets securely.

For example, I’m working on an integration with an external API that requires OAuth access and refresh tokens. I’d like to store those tokens centrally and let my HomeyScripts access them without hardcoding credentials or exposing them in regular variables.

**Proposed solution**

Introduce a built-in Secret Manager with the following capabilities:

1. **Secure storage:** Store API keys, OAuth tokens, passwords, and other credentials encrypted at rest.
2. **HomeyScript integration:** Provide a simple API for authorized scripts to retrieve and update secrets.
3. **Advanced Flow integration:** Allow secrets to be referenced in automations without exposing their actual values in the Flow editor.
4. **Access control:** Restrict which scripts, apps, or automations can access specific secrets.
5. **Secret management:** Provide a central interface to create, update, rotate, and delete credentials.
6. **Protection against accidental exposure:** Mask sensitive values in the user interface and prevent accidental disclosure through logs, exports, or backups wherever technically possible.

**Example usage**

Ideally, HomeyScript could access a stored credential using something like:

const token = await Homey.secrets.get(‘google\_access\_token’);

This is only an illustrative API, not an existing HomeyScript function.

The Secret Manager should also support updating stored tokens, which would be particularly useful for OAuth integrations that periodically refresh their credentials.

**Why this would be valuable**

A native Secret Manager would make Homey significantly more attractive for advanced automations and integrations.

It would:

- Improve security by reducing hardcoded credentials.
- Simplify integration with third-party APIs.
- Make scripts easier to maintain and share.
- Provide a consistent way to handle credentials across the platform.
- Reduce the risk of accidentally exposing sensitive information.

As Homey continues to expand its automation and integration capabilities, I believe secure credential management should become a core platform feature.

**I’d love to hear whether something like this is already being considered and whether other community members would find it useful.**

Thanks!