secret.yaml

---
# GET /v3/secrets/e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4
id: e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4
# upper-case only (as they are environment variables)
name: NPM_TOKEN
# secret should be iron encrypted
value: aHVudGVyMg==
# variable or ssh-key
type: variable
# system, pipeline, or job
scope: pipeline
scopeId: 992b5d666718483c9676361ebc685d122089e3eb
flags:
  # should a PR get this secret
  pr: true
  # what about a PR that's a fork
  fork: false

secrets.yaml

---
# Also support jobId= and buildId=
# GET /v3/secrets?pipelineId=992b5d666718483c9676361ebc685d122089e3eb
- id: e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4
  name: NPM_TOKEN
  type: variable
  scope: pipeline
  scopeId: 992b5d666718483c9676361ebc685d122089e3eb
  flags:
    pr: true
    fork: false
- id: 8e2ad3b8e7ee8cdf34d66b120fae70625ab1a4ae
  name: GIT_KEY
  type: ssh-key
  scope: pipeline
  scopeId: 992b5d666718483c9676361ebc685d122089e3eb
  flags:
    pr: false
    fork: false

That iron encryption seems great. All I can see is **********==.