Passing sensitive data as environment vars via API

[currentjeff]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

iOS (Swift, Objective-C)

Steps to reproduce

Hello, we're considering triggering builds programmatically via the Builds API and passing per-user values through environment.variables in the request body. One of these would be sensitive, and we'd want it not to be readable by anyone who can view that build.

In the Preparing build machine step the sensitive key shows up. It's base64 encoded but ideally it either doesn't show at all or shows similarly to other secret keys added through the UI like

MY_API_KEY=HIDDEN (hash: 9ed40943)

Is that possible? If not, are there any workarounds for obfuscating sensitive information when using the API?

Expected results

The environement variable is masked/hidden similar to other Secrets.

Actual results

The key is unmasked and visible to anyone viewing the build.

Build id (optional)

No response

[dtrdic]

Hello @currentjeff sure.
Firstly, you can store the variable in Codemagic as a secure environment variable and mark it as "secure"

Then when triggering the build via the Builds API, instead of passing the sensitive value directly, you can include the environment group in the request:

In this case, all variables from the client_001 group will be available during the build and since they are marked as "secure", in Codemagic will appear in the "Preparing build machine" step as masked values

[dtrdic]

So just to expand my answer a bit:

You can add environment variables either through the UI;

1. At the App level

2. Or at the Team level (adding it there means that those env variables can be used in codemagic.yaml across all team applications)

Alternatively, you can also use the Codemagic API to upload environment variables programmatically, which can be useful if you have a large number of clients or want to manage values from your own backend or client dashboard.

Here's an example:

curl --request POST \
  --url https://codemagic.io/api/v3/variable-groups/{variable_group_id}/variables \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'x-auth-token: $CODEMAGIC_AUTH_TOKEN' \
  --data '{
    "secure": true,
    "variables": [
      {
        "name": "string",
        "value": "string"
      }
    ]
  }'

Check also this API documentation for reference:
https://codemagic.io/api/v3/schema#tag/secrets-and-environment-vars/POST/api/v3/variable-groups/{variable_group_id}/variables

[currentjeff]

Thanks @dtrdic, I think what's unique my about my situation is that these private values are user-specific so I don't want to have them shared in the Codemagic UI otherwise other people in the same team could in theory use them.

I'm trying to build a workflow where engineers can submit to the iOS app store using their own individual token that is stored locally on their computer, rather than using a shared team token, so that we can restrict who can submit to the store based on their App Store Connect role. So what I am currently doing is passing the local token into Codemagic via the API as a base64-encoded env var, but then they are visible in the Preparing build machine step. Unsure if it's possible to do this securely via Codemagic API

[dtrdic]

Hey @currentjeff just to clarify, there isn't a "shared team token" (if you're referring to the Codemagic API token in AppSettings). Each team member has their own personal API token, teams don't have a common/shared token.

There's also another option if you don't want to store the secrets in Codemagic. You could place your client assets in a settings.env file, store it somewhere like an AWS S3 or GCP bucket, then download that file during the build and write the values to the CM_ENV environment variable.

Something like this:

scripts:
  - name: Get assets from AWS S3 bucket
    script: |
      aws s3 cp s3://$S3_BUCKET_NAME.zip assets.zip
      unzip assets.zip -d $ASSETS_FOLDER
      ls $ASSETS_FOLDER
  - name: Set iOS environment variables from settings.env
    script: |
      source $HOME/clone/$ASSETS_FOLDER/settings.env

      echo "APP_STORE_CONNECT_KEY_IDENTIFIER=$APP_STORE_CONNECT_KEY_IDENTIFIER" >> $CM_ENV
      echo "APP_STORE_CONNECT_ISSUER_ID=$APP_STORE_CONNECT_ISSUER_ID" >> $CM_ENV

      echo "APP_STORE_CONNECT_PRIVATE_KEY<> $CM_ENV
      echo "$APP_STORE_CONNECT_PRIVATE_KEY" >> $CM_ENV
      echo "DELIMITER" >> $CM_ENV

      echo "CERTIFICATE_PRIVATE_KEY<> $CM_ENV
      echo "$CERTIFICATE_PRIVATE_KEY" >> $CM_ENV
      echo "DELIMITER" >> $CM_ENV

This approach lets you keep the client-specific assets and secrets outside of Codemagic while still making them available during the build