Secrets

secrets set stores API keys per environment; they arrive as environment variables. Values are never shown back. Do not put secrets in code or in services.json. Preview and production have separate secrets. For a key only the user has (a payment provider, an API account), use secrets request (or payments connect for Stripe): a one-time link, valid 24 hours, where they paste it in the portal; it never passes through the chat, and they can also add or replace keys themselves under Project › Secrets. A value pasted there reaches a running app at its service's next restart: restart it yourself once they say it's done, or tell them to press Restart in Project › Services. Never ask for a key in the chat; if the user pastes one anyway, don't use it: tell them to replace it at the provider and send the link (secrets set refuses live keys for that reason). Secret values are taken out of everything the tools show you (exec output, files, logs, HTTP answers), so printenv shows [secret NAME]: check that a key is set with secrets list, and whether it works by calling the provider from the app. Keys are read on the server only, never in code the browser downloads (no NEXT_PUBLIC_ key).