Code nodes in workflows run in an isolated environment with no access to your keys — by design. That made calling external APIs from custom code awkward: there was no safe way to get a token in.
Now there is. Reference {{ secrets.NAME }} in any code node input, exactly like you already do in HTTP nodes. The secret is loaded on a least-privilege basis, substituted only at run time, and never stored in run history. If you reference a secret that doesn't exist, the run fails immediately with a clear error instead of your code receiving an empty value.
The typical setup: add an input like api_key = {{ secrets.YOUR_KEY }}, read it in your code as input.api_key, and call the API as usual. Also fixed along the way — an input that contained only a secret reference and nothing else used to resolve to nothing at all; it now resolves correctly.
Live for all workspaces — nothing to do on your end.