# Secrets (https://lazyfrog.dev/docs/secrets)

Secrets are values the app needs but nobody should see: Stripe keys, API tokens, passwords. They reach the app as environment variables.

- **Separate per environment:** test keys for the preview, live keys for the live site.
- **Never shown back,** in the portal or to your AI.
- **Not through the chat:** when your AI needs a key, it sends you a link where you paste it, one by one or as a whole `.env` file. The value goes straight to LazyFrog.
- **Refused in code:** a commit that contains what looks like a key is refused, with the file and line.

Manage them in the portal under **Secrets**.