Store and rotate application secrets
Keep credentials out of code with write-only, versioned and environment-scoped secret references.
Last updated 2026-08-11
What you'll achieve
- Keep credentials out of source, browser code and ordinary records
- Use a preview-only value without exposing production secrets
- Rotate a production secret through an explicit version
Add a secret
Open the project Secrets page, choose the intended environment scope, enter a supported name and submit the value once. BlinkHost stores an encrypted reference and never returns the plaintext value through the normal API.
Use it in a backend module
Reference the secret by name from a backend module capability that permits secret access. Public frontend prefixes such as PUBLIC_ and NEXT_PUBLIC_ are not accepted as private backend secrets. Secret values are never injected into browser JavaScript.
For LiveStack, create a development- or preview-scoped value and start an isolated preview session. LiveStack does not fall back to a production secret when the preview value is missing. A module that needs no secret can run without one.
Rotate safely
Create a new version, deploy the project so the immutable production payload selects it, verify the dependent operation and only then revoke the old provider credential. Preview and production references are independent, so test with a non-production credential before promotion.
Never paste a database or provider connection string into documentation feedback, logs, analytics, source code, browser screenshots or support messages.
Help improve this page
Sign in to send page-specific feedback. For account-specific help, email support@blinkhost.me.