---
title: HTTP, API and MCP credentials are encrypted, and checks can use org secrets
description: The password, bearer token or API-key header on an HTTP, API or MCP check was readable by every member who opened its settings. These values are now stored…
canonical: https://watchfor.io/changelog/2026-10-05-request-secrets-and-variables
---

[All updates](/changelog#2026-10-05-request-secrets-and-variables) 🔒 Security Oct 5, 2026 · v 9.4.3

# HTTP, API and MCP credentials are encrypted, and checks can use org secrets

The password, bearer token or API-key header on an HTTP, API or MCP check was readable by every member who opened its settings. These values are now stored encrypted, shown only as saved, and asked for again if the check's URL moves to another host. To reuse one token across checks or rotate it in one place, add it under Settings → Variables and type {{NAME}} in an auth field, header or request body.

## What changed

- Write-only credentials. Basic and digest passwords, bearer tokens and the values of credential headers (Authorization, Cookie, X-API-Key, anything with token, secret or key in its name) are encrypted for that one check. Settings shows them as saved with a Replace button; the API and MCP return "[redacted]". Leaving a field as it is keeps the saved value.

- They stay where you typed them. Change the check's host, port or scheme (or the basic-auth username) and the form asks for the credential again.

- Org variables and secrets in requests. Authorization: Bearer {{API_TOKEN}} , {{CLIENT_SECRET}} in a token request body, {{USERNAME}} in basic auth: the reference is stored as written, the secret stays encrypted, and changing the variable updates every check that uses it. Run & inspect fills them in too, and blanks saved secrets out of the response it shows.

Existing checks keep working and are moved to encrypted storage automatically.

Docs: [Web checks → Credentials and variables](/docs/monitors/web#credentials-and-variables).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-10-05-request-secrets-and-variables · Site guide: https://watchfor.io/llms.txt