> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usebruno.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using secrets in Request Fields

After you fetch Google Cloud secrets into an environment, reference them the same way as other external secrets in headers, query params, body, and auth fields.

<Tip>
  Syntax is `{{<row-name>.<secret-id>}}` (for example, `{{staging.api-key}}`).
</Tip>

## Variable syntax

For GCP, each environment row **Name** is the namespace. Under it, Bruno nests every secret ID from that project.

**Recommended syntax (v4+):**

```
{{<row-name>.<secret-id>}}
```

If the secret payload is JSON, access a field with a sub-key:

```
{{<row-name>.<secret-id>.<json-key>}}
```

**Examples**

| Stored in GCP                                  | Bruno row Name | Reference                 |
| ---------------------------------------------- | -------------- | ------------------------- |
| Secret ID `api-key` with a plain string value  | `staging`      | `{{staging.api-key}}`     |
| Secret ID `db` with JSON `{ "password": "…" }` | `staging`      | `{{staging.db.password}}` |

For example, with a row named `db_pass` and a GCP secret ID `gcp-sandbox-key-1`, use `{{db_pass.gcp-sandbox-key-1}}` in the request body:

<img src="https://mintcdn.com/bruno-a6972042/mbx6TaHLTf2QakPA/images/screenshots/v4/gcp-secret-manager/gcp-using-secrets.webp?fit=max&auto=format&n=mbx6TaHLTf2QakPA&q=85&s=1853a8cdc26fa6505bb70c83cdbb0ac2" alt="Using GCP secrets in a request" width="2602" height="1144" data-path="images/screenshots/v4/gcp-secret-manager/gcp-using-secrets.webp" />

**Legacy syntax (deprecated):**

```
{{$secrets.<row-name>.<secret-id>}}
```

## Using secrets in scripts

Access secrets from Pre-request and Post-request scripts with `bru.getSecretVar()`:

```javascript theme={null}
const apiKey = bru.getSecretVar('staging.api-key');
req.setHeader('Authorization', 'Bearer ' + apiKey);

// JSON secret sub-key
const password = bru.getSecretVar('staging.db.password');
```

Make sure the GCP Secrets Manager account is configured and secrets are fetched before using them in scripts. Names must match the environment row alias and GCP secret IDs exactly.

## Using secrets with Bruno CLI

To learn more about using secrets with Bruno CLI, see the [CLI Secret Managers documentation](/bru-cli/secret-managers#google-cloud-secret-manager).