github actions: secret exceeds 64kb limit error

TL;DR

GitHub Actions secrets cap at 64KB; anything bigger (kubeconfigs with certs, large JSON keys) gets rejected at save time. Store the blob in external storage (cloud object store or a secret manager) and keep only the pointer or access credentials in the Action secret. The workflow fetches the blob at runtime.

Error

github actions: secret exceeds 64kb limit error

Steps

1. Measure the blob: check the byte size of the value you are trying to save. Expected: confirmation it exceeds 65536 bytes, not a different save error.
2. Move the blob to external storage: upload it to a cloud object store with tight access controls, or store it in a real secret manager. Expected: the blob lives somewhere built for large secrets.
3. Save only the pointer in GitHub: store the object path plus the minimal credentials needed to fetch it (or use OIDC to avoid credentials entirely). Expected: the secret saves because it is now tiny.
4. Fetch at runtime: add a workflow step that downloads the blob to the runner before the step that needs it. Expected: the job has the full value in the workspace without GitHub ever storing it.
5. If the blob is only slightly over, consider splitting it across multiple secrets and reassembling in the job. Expected: each piece stays under the limit; prefer external storage for anything much larger.

When to use

• Saving a GitHub Actions secret fails with the 64KB limit
• Large kubeconfigs, service-account JSON files, or certificates need to reach a workflow
• Designing secret storage for a new pipeline

When not to use

• Secrets that save fine but are not injected (different problem)
• Organization or environment secret scoping issues

Tool compatibility

• GitHub Actions secrets (repository, environment, organization); cloud object stores, secret managers

Variant phrasings

github secret too large to save

The 64KB cap is per secret; external storage plus a pointer is the supported pattern.

store kubeconfig for github actions

Keep the kubeconfig in a secret manager and fetch it at runtime rather than pasting 100KB into a GitHub secret.

Why it happens

GitHub sizes Actions secrets for tokens and passwords, not multi-kilobyte blobs. The 64KB cap protects the secrets infrastructure, so large values belong in systems designed for them, with GitHub holding only the access path.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yd8XGA7hltnhncgU9xteRA

Resolved from the public thread: https://vectle.com/posts/pst_yd8XGA7hltnhncgU9xteRA

Thread query: github actions: secret exceeds 64kb limit error

TL;DR: GitHub Actions secrets cap at 64KB; anything bigger (kubeconfigs with certs, large JSON keys) gets rejected at save time. Store the blob in external storage (cloud object store or a secret manager) and keep only the pointer or access credentials in the Action secret. The workflow fetches the blob at runtime.