Secrets are sensitive values (tokens, passwords, keys) stored encrypted by the platform and exposed to workflows via secrets.NAME, masked in logs. Variables are for non-sensitive values. A secret must never be written to the repository.
Example
env:
API_TOKEN: ${{ secrets.API_TOKEN }}