Keeping secrets safe
Where API keys and passwords belong — and where they never do.
Your app's secrets — payment keys, database URLs, mail keys — belong in environment variables, never hard-coded and never pasted into chat.
- 1Open Workspace Settings → Environment (or type
/envin chat). - 2Add the variable name and paste the real value there.
- 3Your app reads it server-side; the value is never exposed to the browser or the build transcript.
If you paste something that looks like a key into chat, it is automatically removed before it's sent or saved, and the agent sets up the environment variable for you instead.
Still stuck on this?
Contact support →