# Data Feeds: Auth & secrets

> Keys that never reach the browser.

Glider documentation · Data · Web page: https://cgglider.com/docs/pollers/auth/

Sections of this page: [Transports](https://cgglider.com/docs/pollers.md) · [JSON, XML & text](https://cgglider.com/docs/pollers/formats.md) · [Webhooks](https://cgglider.com/docs/pollers/webhook.md) · [WebSockets](https://cgglider.com/docs/pollers/websocket.md) · [HTTP requests](https://cgglider.com/docs/pollers/compose.md) · [Auth & secrets](https://cgglider.com/docs/pollers/auth.md) · [Mapping the response](https://cgglider.com/docs/pollers/mapping.md) · [Schedule & freshness](https://cgglider.com/docs/pollers/schedule.md) · [Probe & diagnostics](https://cgglider.com/docs/pollers/probe.md)

Write {{SECRET_NAME}} anywhere in the URL, a header value, the body, a WebSocket subscribe text or a webhook token. The server substitutes the value at request time; the editor only ever holds the placeholder.

```http
GET https://api.example.com/v1/scores?key={{SPORTS_API_KEY}}
Authorization: Bearer {{SPORTS_TOKEN}}
```

- Secret names match /^[A-Za-z_][A-Za-z0-9_]*$/.
- An unknown name fails the request with “Unknown secret: <name>” rather than sending an empty value.
- Data feeds are forced to the server runtime, so the substituted value never exists in the browser.
- Create the secrets first, in Logic → Secrets.

> **Not for client units:** Only server-runtime units can resolve secrets. A client unit has no access to them by construction — that is the point.