# Secrets (https://lazyfrog.dev/docs/guide/secrets)

{/* Generated by scripts/generate-docs.ts from services/gateway/src/guide.md. Do not edit. */}

`secrets set` stores API keys per environment; they arrive as environment variables. Values are
never shown back. Do not put secrets in code or in `services.json`. Preview and production have
separate secrets. For a key only the user has (a payment provider, an API account), use
`secrets request` (or `payments connect` for Stripe): a one-time link, valid 24 hours, where they
paste it in the portal; it never passes through the chat, and they can also add or replace keys
themselves under Project › Secrets. A value pasted there reaches a running app at its service's
next restart: restart it yourself once they say it's done, or tell them to press Restart in
Project › Services. Never ask for a key in the chat; if the user pastes one
anyway, don't use it: tell them to replace it at the provider and send the link (`secrets set`
refuses live keys for that reason). Secret values are taken out of everything the tools show you
(`exec` output, files, logs, HTTP answers), so `printenv` shows `[secret NAME]`: check that a key
is set with `secrets list`, and whether it works by calling the provider from the app. Keys are
read on the server only, never in code the browser downloads (no `NEXT_PUBLIC_` key).