Secrets
Where the keys for outside services live, how they are used, importing a .env file, and the named keys that route AI and email through your own accounts.
Last updated September 17, 2026
On this page
A key for an outside service, a payment provider, a mapping service, your own AI account, is a secret. Secrets live under Secrets in the dashboard, encrypted. Anything you put in code can be read by anyone who opens your app; a secret cannot.
How they work
- A saved value is encrypted and never shown again, not even to you. Saving the same name again replaces it.
- Only backend functions can read a secret, and only the functions that declared it. Page code has no access.
- Name them the way the service does: capitals and underscores, such as
STRIPE_SECRET_KEY.
Adding secrets
| Way | When |
|---|---|
| A secret card in the builder | The builder asks for a key at the start of a job. Paste it and the next message resumes. |
| Add secret on the Secrets tab | Any time, by name and value. |
| Import .env | Paste the contents of a .env file or upload it. Each KEY=value line becomes a secret; existing names are replaced. Nothing is sent until you press Import. |
Named secrets the platform recognises
| Name | Effect |
|---|---|
OPENAI_API_KEY or ANTHROPIC_API_KEY | Your app's AI features run through your own account and no credits are charged for them. |
Rotating a key
Save the new value under the same name. Functions read the current value on each run, so the change takes effect immediately.
Publishable versus secret keys. Some providers give you two keys. A publishable key is designed to sit in a page and can go in the code. A secret key never can: it goes in Secrets and is used only inside a backend function.
Was this page helpful?