How to use GitHub Secret Scanning for your Workato Developer API

Workato

What happens if a Workato API token is exposed? GitHub Secret Scanning detects leaked credentials in public repos to help secure your integrations.

Image: Quandary Consulting Group - GitHub Secret Scanner for Workato Developer API

Starting from mid-May 2023, **Workato Developer API client tokens **are now integrated with GitHub Secret Scanning(opens new window), allowing us to provide additional layers of security when your API tokens are found in plain text on public GitHub repositories.

How does GitHub Secret Scanning Workato Developer API Client Tokens Work?

GitHub Secret Scanning automatically monitors public repositories for sensitive credentials, including Workato Developer API tokens.

  • If a **Workato API **token is committed in plain text to a public repository:

  • GitHub scans and detects the exposed token

  • The exposure is flagged as a potential security risk

  • Appropriate alerts and actions can be triggered

This integration enables faster detection and response to credential leaks, helping protect your Workato environment.

When these tokens are found, Workato will perform the following steps:

  1. Revoke your Developer API token to ensure no bad actors can have unauthorized access to your Workato workspace

  2. Send an email to the workspace admins about the leaked token, including information about where it was found and how to recover from the leaked token

Image: Quandary Consulting Group - GitHub; Leaked token email

**Workato PRO TIP: **Remember to add your Workspace admins to your email notification lists to ensure that relevant individuals are informed if tokens are leaked. This can be done by going to your Workspace settings(opens new window) when logged in as the workspace admin.

  1. Mark the API Client as leaked on the Workato UI

  2. Add an audit log event indicating that the API token was leaked

Image: Quandary Consulting Group, GitHub, leaked token audit event screenshot

Why does Workato Revoke Tokens Immediately?

Human error is one of the most common ways that malicious actors can access your account. We have found that many bad actors use crawlers on GitHub public repositories to find leaked tokens which makes it important that we are able to secure your Workato workspace.

  • This process is also aligned with many best practices proposed by tools like GitLab and Okta, and more!

Key Benefits for Workato Users

  • Enhanced API Security Provides an additional layer of protection for Workato integrations and automation workflows.

  • Real-Time Detection of Exposed Tokens Identifies leaked API tokens quickly, reducing the window of vulnerability.

  • Reduced Risk of Unauthorized Access Helps prevent misuse of exposed credentials and protects sensitive data.

  • Alignment with Security Best Practices Supports secure development practices, including DevSecOps and credential management standards.

  • By: John Orsak

  • Title: Senior Developer, Workato Delivery Team

  • Updated: January 19, 2026

  • Email: jorsak@quandarycg.com