Skip to main content
Secrets let you store API keys, database URLs, and other sensitive configuration for your projects. They are encrypted at rest and injected into your project’s runtime environment automatically.

​
Adding a Secret

  1. Open your project and go to Settings > Secrets
  2. Enter a key (e.g. STRIPE_SECRET_KEY) and a value
  3. Click Add Secret
The secret is encrypted and stored immediately. Your project’s container will have access to it as an environment variable on the next restart.

​
Using Secrets in Code

Access your secrets through environment variables:
Vite-based projects require the VITE_ prefix for environment variables that need to be available in the browser. Server-side variables (used in API routes or Edge Functions) do not need the prefix.

​
Managing Secrets

  • View: The dashboard shows which secrets exist, but never displays their values
  • Update: Add a secret with the same key to overwrite the previous value
  • Delete: Remove secrets you no longer need from the settings panel

​
Best Practices

  • Never hardcode secrets in your source code. Always use environment variables.
  • Use descriptive key names like SUPABASE_URL or OPENAI_API_KEY so they are easy to identify.
  • Keep secrets minimal. Only store what your project actually needs.
  • Rotate keys regularly if a service supports it. Update the secret in Aurora and restart your container.

​
How It Works

Secrets are encrypted before being stored and only decrypted server-side when your container starts. They are injected directly into the runtime environment and are never sent to the browser or included in your project’s source code.
If you use the VITE_ prefix, the value will be bundled into your frontend code and visible to anyone who inspects your site. Only use VITE_ for values that are safe to expose publicly (like a Supabase anon key). Keep truly sensitive keys server-side only.