HappySeeds

Secrets and Environment Variables

Secrets is the Cloud feature for storing private runtime values such as API keys, access tokens, and webhook secrets.

What belongs in Secrets

Put private service credentials in Cloud > Secrets, not in page copy or visible code.

Common examples:

  • STRIPE_SECRET_KEY
  • OPENAI_API_KEY
  • SLACK_WEBHOOK_URL
  • OAuth client secrets
  • database or storage service credentials

What should not be public

Never paste private keys into content that visitors can see. Do not put secret values in headings, paragraphs, buttons, or public configuration.

If a third-party service gives you both public and private keys, ask the AI where each one belongs. Public browser keys and private server secrets are not interchangeable.

Use clear names

Use names that explain the service and purpose. Clear names make it easier for AI and teammates to wire the app correctly.

Good examples:

  • STRIPE_SECRET_KEY
  • GOOGLE_CLIENT_SECRET
  • BREVO_API_KEY

Rotate exposed keys

If you accidentally share a secret in chat, screenshots, or public code, replace it in the original provider dashboard. Updating the value in HappySeeds is not enough if the old key is already exposed.