Secrets and the Access Token column

Tool Account has a text column named Access Token that holds bot credentials in clear text. It breaks a group rule, it is copied to another base and a running workflow depends on it. Do not type into it, read it, copy it or build anything new on it.

The rule

The global System Rule “Secrets are referenced, never stored” says that passwords, tokens, keys and bank details are never typed into a text field; a field holds only the vault path or key name. Secret Ref on Tool and on Tool Account follows that rule: it is meant to hold a pointer, never the secret.

What exists today

• Access Token is a single-line text field on Tool Account. Its description asks for the bot token in clear text and says Secret Ref names a vault entry that mirrors it. Both contradict the rule.
• The column is visible in all seven Tool Account views, including ops:ToolAccount Sync. That view’s field set matches the CRM Tool Account mirror, and the CRM copy has an Access Token column. Anyone who can open either base can read a filled cell.
• Since 2026-09-18, Secret Ref on the Slack bot accounts has pointed back to the Access Token cell, not to a vault. Check the current Secret Ref values before relying on them.

Treat every Access Token cell, in this base and in CRM, as possibly filled until a maintainer confirms otherwise.

Why the column exists

On 2026-09-18 the Slack bot tokens of the group’s workspaces moved from the legacy base into this column. The n8n Slack flow builds its credential at run time from the bot’s Tool Account row, and the token had to live somewhere that flow could read. Today the active Slack — Workspace Token Cache workflow reads the bot accounts every five minutes and keeps their tokens in an n8n Data Table. The Daily Digest and Reading Reply workflows read that cache, not this base. See Workspace cache.

Do not use it

• Leave Access Token blank on every new account. Human and shared accounts never have a token.
• Do not screenshot, export, print or share a Tool Account view, and do not add Access Token to a new view, sync or API request.
• A new workflow that needs a credential uses n8n credentials or a secret store, with a pointer in Secret Ref. It never reads Access Token.
• If you see a token outside the base, in CRM, a screenshot, a log or a message, treat it as exposed: rotate it in the tool and tell the maintainer.

The way out

The Work Item “Move the Tool Account Access Token out of Airtable” (High, To Do) is done when the column is removed and the token sits in a secret store. Its steps are not decided. Until it ships, the token cache depends on the column: removing, renaming or emptying it without changing that workflow stops Slack notifications with BOT_NOT_CONFIGURED or BOT_TOKEN_MISSING. Removing the column from ops:ToolAccount Sync is a separate step for the CRM copy.