Environment variables and secrets
Projects can store environment variables for the sandbox and published deployments.Why use project env vars
- Keep API keys out of source control
- Give the agent and runtime the same configuration
- Rotate values without rewriting code
Typical workflow
- Open project settings
- Add keys such as
STRIPE_SECRET_KEY,OPENAI_API_KEY, or your own service credentials - Ask the agent to read from
process.env/ framework env conventions - Republish if a deployed app must pick up new values
Security tips
- Never commit secrets into the repo
- Prefer server-only keys for privileged operations
- If a secret leaks in chat history, rotate it at the provider and update project settings