Where do I store the Cyberlop URL and API token in my CI's settings?

Steps

1. Open your repository in your code host and go to Settings.
2. Choose CI/CD, then Variables.
3. Create a variable with the key CYBERLOP_URL. The value is the base URL of your Cyberlop app.
4. Next, create a variable with the key CYBERLOP_API_TOKEN and paste your personal API token as the value, exactly as the admin gave it to you.
5. Mark both as masked variables, then save.

Good to know

The comment at the foot of the generated pipeline tells you the same thing: set both as masked CI/CD variables in Settings → CI/CD → Variables. This applies to the second tab on the Integrations page, the one for a CI/CD pipeline.

The profile ID is different. It sits in the YAML as PROFILE_ID, because an ID is not a secret and your team may want to see what the job scans.

Masking hides a value from the job log, but it does not protect a token that you paste into the YAML file itself. Keep it in the variable. If you think a token has leaked, ask an admin to regenerate it, then update the variable. See what to do about a lost API token.

Workflow users on the first tab store the same two values as repository secrets. That page is which secrets to add to your repository.

Related questions

• Which secrets do I need to add to my repository for CI scans?
• How do I get a personal API token?
• I lost my API token. Can I see it again?
• How do I copy the ready-made CI workflow for my code host?
• My CI job can't trigger a scan. What should I check?

Full tutorial

How to add security scanning to your CI/CD pipeline

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre