title: Secret Variables in Azure Pipelines
body: <p>I have an Azure pipeline that needs to access a secret token to contact another service.  I've been following the <a href="https://docs.microsoft.com/en-us/azure/devops/pipelines/process/variables?view=azure-devops&amp;tabs=yaml%2Cbatch#secret-variables" rel="nofollow noreferrer">documentation</a>, but it does not seem to work as I'd expect.  As a minimal example, I'm trying to write the variable in <code>cachix_token</code> to a file.</p>
  <pre><code>  - bash: |
        set -ex
        mkdir -p packages
        echo $CACHIX_AUTH_TOKEN &gt; packages/token
      env:
        CACHIX_AUTH_TOKEN: $(cachix_token)
  </code></pre>
  <p>However, when I download the resulting the token file, the contents are a literal</p>
  <pre><code>$(cachix_token)
  </code></pre>
  <p>How do I get yaml to substitute in the secret variable?</p>
  <h1>Update</h1>
  <p>Below is a screenshot of where I've defined the secret variable for the pipeline.</p>
  <p><a href="https://i.stack.imgur.com/PVhyr.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PVhyr.png" alt="enter image description here" /></a></p>