> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aurora.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> Store API keys and configuration securely in your Aurora projects

Secrets let you store API keys, database URLs, and other sensitive configuration for your projects. They are encrypted at rest and injected into your project's runtime environment automatically.

## Adding a Secret

1. Open your project and go to **Settings > Secrets**
2. Enter a **key** (e.g. `STRIPE_SECRET_KEY`) and a **value**
3. Click **Add Secret**

The secret is encrypted and stored immediately. Your project's container will have access to it as an environment variable on the next restart.

## Using Secrets in Code

Access your secrets through environment variables:

```typescript theme={null}
// In your project code
const apiKey = import.meta.env.VITE_API_KEY;

// For server-side code
const secretKey = process.env.STRIPE_SECRET_KEY;
```

<Note>
  Vite-based projects require the `VITE_` prefix for environment variables that need to be available in the browser. Server-side variables (used in API routes or Edge Functions) do not need the prefix.
</Note>

## Managing Secrets

* **View**: The dashboard shows which secrets exist, but never displays their values
* **Update**: Add a secret with the same key to overwrite the previous value
* **Delete**: Remove secrets you no longer need from the settings panel

## Best Practices

* **Never hardcode secrets** in your source code. Always use environment variables.
* **Use descriptive key names** like `SUPABASE_URL` or `OPENAI_API_KEY` so they are easy to identify.
* **Keep secrets minimal**. Only store what your project actually needs.
* **Rotate keys regularly** if a service supports it. Update the secret in Aurora and restart your container.

## How It Works

Secrets are encrypted before being stored and only decrypted server-side when your container starts. They are injected directly into the runtime environment and are never sent to the browser or included in your project's source code.

<Warning>
  If you use the `VITE_` prefix, the value will be bundled into your frontend code and visible to anyone who inspects your site. Only use `VITE_` for values that are safe to expose publicly (like a Supabase anon key). Keep truly sensitive keys server-side only.
</Warning>