# Nextflow Secrets produces empty string due to wrong path

**URL:** <https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673>\
**Category:** Ask for help\
**Tags:** nextflow, credentials\
**Created:** [January 29, 2025, 2:03pm UTC](https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673 "2025-01-29T14:03:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pwolk](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/pwolk/32/1402_2.png) [@pwolk](https://community.seqera.io/u/pwolk)\
**Post date:** [January 29, 2025, 2:03pm UTC](https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673/1 "2025-01-29T14:03:39Z")

</div>

Hi guys, I have a problem with Nextflow secrets.  
My process looks like this:

```auto
process FOO {

    time '24h'
    secret 'USERNAME'
    secret 'PASSWORD'

    input:
    [...]

    output:
    [...]

    script:
    """
    #!/usr/bin/env bash
    ## dummy echo for testing
    echo \$USERNAME
    echo \$PASSWORD
       [...]
    """
}

```

USERNAME and PASSWORD exist in nextflow secrets. When I run the process, both echo commands print empty strings. If I change the name of the secrets variable, it fails, so Nextflow recognizes that USERNAME and PASSWORD exists. But of course this doesn’t help me. When I look into the .command.log, I see the following telling text:

```auto
grep: ./secrets/.nf-ec9a753b-9de3-466f-b0ec-c5e6b1a407d6.secrets: No such file or directory

```

So, Nextflow wants to look into the secrets directory in the current work dir, but the secrets directory is in my project root!  
Looking into the .command.run, my suspicion is confirmed, Nextflow changes into the workdir before trying to read from the secrets file in root dir:

```auto
    [["${NXF_CHDIR:-}"]] && cd "$NXF_CHDIR"
    NXF_SCRATCH=''
    [[$NXF_DEBUG > 0]] && nxf_env
    touch [workdir....]/.command.begin
    set +u
    # conda environment
    source $(conda info --json | awk '/conda_prefix/ { gsub(/"|,/, "", $2); print $2 }')/bin/activate foo
    set -u
    export PATH="$PATH:/foo/bar"
    source /dev/stdin <<<"$(cat <(grep -w -e 'USERNAME=.*' -e 'PASSWORD=.*' ./secrets/.nf-ec9a753b-9de3-466f-b0ec-c5e6b1a407d6.secrets))"

```

Am I using secrets wrong? Do I have to give the secrets dir as input? Because linking it into the workdir would work, but would contradict the use of secrets imo. Or is it a bug?

---

<div class="post-metadata">

**Author:** ![mribeirodantas](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/mribeirodantas/32/235_2.png) [@mribeirodantas](https://community.seqera.io/u/mribeirodantas)\
**Post date:** [January 29, 2025, 2:12pm UTC](https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673/2 "2025-01-29T14:12:58Z")

</div>

Hi @pwolk ! Welcome to Seqera Community Forum 🙂

How did you create the secrets? I tried to reproduce your situation the following way and it worked:

`secrets.nf`

```Groovy
process FOO {                                                                      
    debug true                                                                     
                                                                                   
    time '24h'                                                                     
    secret 'USERNAME'                                                              
    secret 'PASSWORD'                                                              
                                                                                   
    script:                                                                        
    """                                                                            
    #!/usr/bin/env bash                                                            
    ## dummy echo for testing                                                      
    echo \$USERNAME                                                                
    echo \$PASSWORD                                                                
    """                                                                                                                                                      
}                                                                                  
                                                                                   
workflow {                                                                         
  FOO()                                                                            
}

```

```console
# Creating secrets
nextflow secrets set USERNAME Marcel
nextflow secrets set PASSWORD Marcelpass
nextflow run secrets.nf

```

 ![CleanShot 2025-01-29 at 11.11.22@2x](https://europe1.discourse-cdn.com/flex013/uploads/seqera/original/2X/d/d223eab0982172b5f41ae84adbe353d705d332d2.png)

I don’t see in my `.command.log` or `.command.run` the same thing you’re seeing.

```auto
...
source /dev/stdin <<<"$(cat <(grep -w -e 'USERNAME=.*' -e 'PASSWORD=.*' /Users/mribeirodantas/.nextflow/secrets/.nf-ef20b430-8476-43f7-a171-3b82e5e61 ae1.secrets))"
...

```

---

<div class="post-metadata">

**Author:** ![pwolk](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/pwolk/32/1402_2.png) [@pwolk](https://community.seqera.io/u/pwolk)\
**Post date:** [January 29, 2025, 2:21pm UTC](https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673/3 "2025-01-29T14:21:01Z")

</div>

Thank you for trying it out!

I just did it like you!  
nextflow secrets set USERNAME paul

---

<div class="post-metadata">

**Author:** ![pwolk](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/pwolk/32/1402_2.png) [@pwolk](https://community.seqera.io/u/pwolk)\
**Post date:** [January 29, 2025, 2:26pm UTC](https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673/4 "2025-01-29T14:26:04Z")

</div>

Okay, sorry for wasting your time. 😃 I just found out the reason:  
The bash script that starts the pipeline runs a command that sets the NXF\_HOME variable, but the command to determine what to use as home produces just “.”, so this is used also to determine the secrets directory and results in this ./secrets… . ahhh ☹ using realpath in front of that command solves it.

---

<div class="post-metadata">

**Author:** ![mribeirodantas](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/mribeirodantas/32/235_2.png) [@mribeirodantas](https://community.seqera.io/u/mribeirodantas)\
**Post date:** [January 29, 2025, 5:44pm UTC](https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673/5 "2025-01-29T17:44:08Z")

</div>

Thanks for coming back to share the explanation of what led to the reported scenario, @pwolk ! Great to hear you’ve solved it 🥳

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex013/user_avatar/community.seqera.io/system/32/2402_2.png) [@system](https://community.seqera.io/u/system)\
**Post date:** [February 5, 2025, 5:44pm UTC](https://community.seqera.io/t/nextflow-secrets-produces-empty-string-due-to-wrong-path/1673/6 "2025-02-05T17:44:33Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.