Settings and secrets

Most apps need a few values that are not in the code: a database password, a key for a payment service, the address of an API. There are two places for them, and which one you pick matters.

Run-time settings: where secrets go

Open your app, then Settings. Each setting has a Name and a Value. Your app reads them while it is running.

Once saved, a value is hidden. Nobody can read it back, including you. You can only replace it or delete it.
A name uses only letters, numbers and underscores, and does not start with a number.
Only a workspace admin can see or change these settings.
1ClickOps stores them encrypted.

Saving is not the same as applying

After you save, the card says your changes are saved but not live. Press Apply changes to put them to work.

For an app deployed from a repository, applying rebuilds the version that is live now with the new settings. It does not bring in newer code, and it does not run your database update command.
For other apps, applying restarts the app with them.
The card tells you which will happen: either your site stays on the current version until the new one is ready, or the app restarts and may be unavailable for a moment.

Build-time settings: public values only

Some apps read values while they are being built and copy them into the pages your visitors download. Those go in a different place: the card How this app is built, under Settings needed while building.

Anything you put there can end up inside the pages your visitors download. Anyone can open a downloaded page and read what is in it. So a password or a secret key never belongs in build-time settings.

Put public values there, such as the public address of your API. Settings whose names begin with NEXT_PUBLIC_ or VITE_ are of this kind.

The two do not replace each other. A page that was already built does not change when you change a run-time setting. A build-time value takes effect at the next build.

Which one do I need?

A database password, a secret key, a sign-in token: run-time. Always.
An address or a key that your pages show to every browser anyway: build-time.
Not sure? Treat it as a secret and use the run-time settings.

Worth knowing

What your app prints is kept, so you can see what happened during a build. If your app prints a secret, that secret is in the stored output.
Connecting a database adds its setting for you. See Databases.
A staging copy has its own settings. Changing them does not change your live site’s. See Staging and “Push live”.
An AI app you connect can set these values, but never read them back. See Connect an AI app.