Keys stay on the platform, not in your code
Save an API key or password as a secret for a platform hosted app. It is encrypted, never shown again, and reaches your container as an environment variable when it deploys.
Secrets · Rider Sync
Add or replace
- Key
- COURIER_API_KEY
- Value
- ••••••••••••••••••••
Secrets
- DATABASE_URL is set by the platform Refused
- COURIER_API_KEY · encrypted, value hidden Saved
- Passed to the container as an environment variable Deployed
In short
App secrets store keys for platform hosted apps: each has a Key and a Value, is encrypted at rest and write only, and is passed to the app's container as an environment variable at deploy time. Secrets can be set from the partner centre, the CLI or GraphQL.
The problem it solves
An API key committed to a repository is a key everyone with access to the code can use, forever. Rotating it means another release.
How it works
3 steps, start to finish
-
1
Add a secret
Enter a Key and a Value and Save secret.
-
2
It is locked away
The value is encrypted and cannot be read back, only replaced or deleted.
-
3
It reaches your app
On deploy it is injected into the container as an environment variable.
In detail
What app secrets does for you
-
Encrypted
Secrets are encrypted at rest.
-
Write only
Only names are listed; values are never shown again.
-
CLI and GraphQL
config set, list and unset from the CLI, or setAppSecret in GraphQL.
-
Reserved names
Names beginning FLASHMANDU_, DATABASE_URL and PORT are set by the platform.
-
Platform hosted apps. A self hosted app keeps its own secrets on its own servers.
-
No. Secrets are write only; you can replace or delete one, and list their names.
-
As an environment variable in its container, injected at deploy time.
App secrets · Free to start
Try app secrets on your own business
Set up in a couple of minutes. Your catalogue, orders and books stay yours to export.
- Live in 2 minutes
- Free to start
- No credit card
