Skip to main content
Secrets store the passwords Bolt needs to connect your app to other services. For example, if your app processes payments, sends email to your users, or lets users sign in using Google SSO, Bolt needs to store those credentials safely and keep them hidden from users. Bolt’s server functions, sometimes called edge functions, use secrets to connect to outside services on your behalf. Server functions run behind the scenes on Bolt’s servers rather than in the user’s web browser, which prevents secret values from showing up where your users could see them.

​
How secrets work

Bolt prompts you automatically when you need to add a secret. For example, if you ask Bolt to let your app send emails, it completes the code, then displays a message asking you to add your email service’s key as a secret on the Secrets page in your database settings. Secrets only work with server functions. Bolt reads a secret’s value only when a server function needs to use it. Bolt never writes that value into your project’s files, the code that runs in your users’ browsers, or your published site (the live version of your app that users visit on the web).

​
Who can view and manage secrets

Viewing and managing a project’s secrets is limited to certain roles. The following roles have access:
  • Individual account: Project owner only.
  • Team account: Project owner, Co-owners, and team Admins have access. Editors and Viewers don’t.
If you don’t have access, the Secrets tab shows the message, “Project admin access required.”

​
View secrets settings

You need a database connected to your project before you can open the Secrets page. Server functions rely on your database to run, so you can’t add server functions or secrets unless you have a database set up first. Bolt sets up a database automatically when your project needs one. If your project doesn’t have a database yet, ask Bolt to add one. To open the Secrets page for your project’s database:
The Secrets page in the Bolt database settings.
  1. Open your Bolt project.
  2. In the top menu, click the database icon, then click Secrets.

​
Find the value for a secret

When Bolt asks you to add a secret, the value doesn’t come from Bolt. It’s a key or password from the outside service your feature connects to. To find it:
1

Identify the service and secret name

Read Bolt’s message to see which service it needs (for example, Stripe, Resend, or Google SSO) and the name of each secret it lists.If you don’t already have an account with that service, you’ll need to create one. Bolt sets up the code, but you have to create an account and get the key yourself. If a secret’s name doesn’t tell you which service it belongs to, ask Bolt in the chat which service it used.
2

Get the key from the service

Sign in to that service’s website and open its API keys or developer settings. Create a new key or copy an existing one.
Many services show a new key only once. Copy it as soon as you create it. If you lose it, create a new key.
The terminology for a secret key varies by company. When you’re signed into the service, look for “API keys,” “Developers,” or “Credentials” in its dashboard.For Stripe, Google, or Resend, see the following articles for specific instructions on where to find the key you need:
3

Add the key as a secret

Continue to the next section for steps to add the key as a secret in Bolt.

​
Add a secret

  1. Open your Bolt project.
  2. In the top menu, click the database icon, then click Secrets.
  3. In Name, enter the secret’s name exactly as it appears in Bolt’s message, such as RESEND_API_KEY. Names are case-sensitive.
  4. In Value, enter the secret key you got from the outside service. For security, the secret value is hidden as you type.
  5. Click Save.

​
Delete a secret

  1. Open your Bolt project.
  2. In the top menu, click the database icon, then click Secrets.
  3. In the row of the secret you want to remove, click Delete.
Secrets prefixed SUPABASE_ are reserved for Bolt’s own database connection and can’t be deleted.
Deleting a secret removes its value from Bolt, but it doesn’t disconnect any integration that used the secret. If any server function uses the secret, it will stop working unless the secret is added back.

​
How are secrets different from environment variables?

Environment variables are values your project’s code can read directly while your app runs, including code that runs in the user’s web browser. Bolt stores these values in your project’s .env file, which is part of your project’s code. Because the .env file can hold sensitive values, like API keys and authentication tokens, Bolt hides it from collaborators with view-only access. Editors and co-owners can still see it, and if your code reads a value from the browser, that value ends up in what’s sent to anyone visiting your published site. See Sharing your project for more on collaborator access. Secrets work differently. Bolt only makes a secret’s value available to your server functions. Once you create a secret, Bolt doesn’t show its value again to anyone, and it doesn’t write that value into your .env file, your other project files, or your published site. Environment variables are best for values that your code needs to read directly, including in the browser. Secrets are best for values that only your server functions need, like a payment provider’s secret key or an email service’s API key, since secrets keep that value out of your code and your published site entirely. Bolt helps you determine which to use. If your project has a database, Bolt automatically fills in some .env values for you, such as the web address and public key your database needs to connect, and locks those specific values so you can’t edit them by hand. To connect a different database instead, use your database’s Advanced settings rather than editing .env directly. You can still edit any other values already in .env as usual.

​
Tips for improved security

  • Change your keys regularly. If an old key was ever exposed without your knowledge, replacing it often limits how long someone else could use it.
  • Remove keys you no longer use.
  • Never paste secret values directly into your project’s code, where anyone who sees the code could read them. Add them as secrets instead.