Skip to main content

Site Secrets

Securely store and manage sensitive configuration values like API keys, credentials, and connection strings.

Overview​

Site Secrets provides a secure way to store sensitive information that your applications need at runtime. Secrets are encrypted at rest and can be accessed by your functions and services without exposing them in code.

Concepts​

Secret​

A secret is a key-value pair containing sensitive data such as API keys, database credentials, or third-party service tokens. Secrets are encrypted and securely stored.

Secret Type​

A template that defines the structure of a secret. Secret types specify what fields a secret should contain and their validation rules.

Secret Scope​

Secrets can be scoped to the site level (available to all apps) or app level (available only to a specific app).

View Secrets​

  1. Navigate to your Site in the Dashboard.
  2. Click the Secrets tab.
  3. View the list of all site-level secrets.

Create a Secret​

  1. Navigate to your Site in the Dashboard.
  2. Click the Secrets tab.
  3. Click Create Secret.
  4. Fill in the secret details:
    • Name: A descriptive name for the secret
    • Type: Select a secret type (if configured)
    • Value: The secret value (encrypted on save)
  5. Click Create.
tip

Use descriptive names that indicate what the secret is for, such as stripe_api_key or database_password.

View Secret Details​

  1. Navigate to the Secrets tab.
  2. Click on a secret to view its details.
  3. The secret value is hidden by default for security.
  4. Click the Show button to reveal the value temporarily.
warning

Be careful when revealing secret values, especially when screen sharing or in public spaces.

Update a Secret​

  1. Navigate to the Secrets tab.
  2. Click the Edit icon on the secret you want to update.
  3. Update the secret value.
  4. Click Save.
note

Updating a secret value may require restarting services that use it.

Delete a Secret​

  1. Navigate to the Secrets tab.
  2. Click the Delete (trash) icon on the secret.
  3. Confirm deletion in the dialog.
warning

Deleting a secret may break applications that depend on it. Ensure no services are using the secret before deletion.

Secret Types​

Secret types define the structure and validation for secrets.

View Secret Types​

  1. Navigate to Site Settings.
  2. Click Secret Types in the sidebar.
  3. View all configured secret types.

Create a Secret Type​

  1. Navigate to Site Settings > Secret Types.
  2. Click Create Secret Type.
  3. Configure the type:
    • Name: Display name for the type
    • Key: Unique identifier
    • Schema: JSON schema defining required fields
  4. Click Create.

Using Secrets in Functions​

Secrets can be accessed in your serverless functions at runtime:

  • Secrets are injected as environment variables
  • Access them using standard environment variable methods
  • Never log or expose secret values in your code

Configuration​

Secret Fields​

FieldDescriptionRequired
NameDescriptive name for the secretYes
TypeSecret type templateNo
ValueThe encrypted secret valueYes
DescriptionOptional notes about the secretNo

Best Practices​

  1. Use descriptive names: Make it clear what each secret is for
  2. Rotate regularly: Update secrets periodically for security
  3. Limit access: Only give access to users who need it
  4. Don't hardcode: Always use secrets instead of hardcoding values
  5. Audit usage: Monitor which services use which secrets

Limits​

ResourceLimit
Secrets per site100
Secret name length256 characters
Secret value size64 KB
info

Need higher limits? Contact support to discuss your requirements.

Troubleshooting​

Secret not available in function​

Problem: A function cannot access a secret at runtime.

Solution:

  1. Verify the secret exists and is correctly named.
  2. Check that the function has access to site-level secrets.
  3. Redeploy the function after adding new secrets.

Cannot delete secret​

Problem: Deletion fails with a dependency error.

Solution:

  1. Check which services are using the secret.
  2. Update or remove those dependencies first.
  3. Then delete the secret.

Last Updated: January 2025