Studio

Project secrets

Store third-party credentials (API keys, tokens, passwords) as project secrets. They are encrypted at rest, never shown in full after saving, and available to your generated app as environment variables at runtime.

Where to find secrets

Open your project in Studio and go to Cloud in the left panel, then select Secrets. You can add, update, or delete secrets from this screen.

Adding a secret

Click Add secret, enter the key name and value, and save. Key names must follow standard environment variable naming rules: all uppercase letters, digits, and underscores, starting with an uppercase letter (for example STRIPE_SECRET_KEY or OPENAI_API_KEY).

Once saved, the value is encrypted and never returned to the UI. The list shows only the key name, when it was last updated, and the last four characters of the value as a hint (shown as ...xxxx).

Note
A project can hold up to 50 secrets. If you need more, consider a dedicated secrets manager for credentials that do not need to be read by the generated app at runtime.

Using secrets in generated code

When you ask Studio to use a credential (for example, "connect to Stripe using my secret key"), the AI knows the names of your configured secrets and writes code that reads them from process.env. The actual values are never included in the generated source.

typescriptExample: reading a secret in generated code
// In your generated server-side code:
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY, { apiVersion: "2024-04-10" });

Secrets are injected as environment variables into the running sandbox whenever a build starts. If you update a secret while your sandbox is already running, the change is applied immediately without waiting for the next build.

Security properties

  • Encrypted at rest. Each value is encrypted before it is stored in the database. The plaintext is never persisted.
  • Never logged. Secret values do not appear in build logs, AI context, or any Studio activity record.
  • Not reversible through the UI. Once saved, you cannot retrieve the original value. If you lose a credential, replace it with a new one from the issuing service.
  • Masked in console logs. Common secret patterns are masked automatically in the project console output so a leaked console.log does not expose a stored credential.
Chat with us