Secrets: store API keys and passwords safely

Secrets let you store API keys and passwords safely so they never appear in your app code.

Some features need a private key, for example an email service or a payment provider. These keys must stay private. If you put them straight into your app code, anyone who views the app could find them. Secrets solve this.

How to use secrets

• Open the Secrets tab and add a new secret with a name and its value.
• Refer to the secret by its name from your backend functions.
• The real value stays on the server and is never sent to the browser.

Never hardcode a key: Do not paste an API key directly into a screen or component. Always store it as a secret and read it on the backend. This keeps your account and your users safe.

When you rotate a key with a provider, update the matching secret and your app keeps working without a code change.