How to connect Replit to external APIs

Open the Tools dock on the left sidebar of your Replit workspace and click Secrets. In the App Secrets tab, click the plus button to add a new secret. Enter the key name (use uppercase with underscores, such as STRIPE_API_KEY or TWILIO_AUTH_TOKEN) and paste the value. Replit encrypts all secrets with AES-256 encryption and transmits them over TLS. You can add multiple secrets for different services. Use the Edit as JSON or Edit as .env buttons for bulk entry if you are migrating from another platform.

In Node.js, access secrets through the process.env object. Create a configuration file that centralizes all your API credentials in one place. This makes it easy to see which services your project depends on and catches missing secrets early with clear error messages. Never import dotenv or create .env files in Replit. The Secrets panel replaces .env files entirely, and secrets are automatically injected as environment variables at runtime.

1// config.js — centralize all API credential access
2const config = {
3  stripe: {
4    secretKey: process.env.STRIPE_SECRET_KEY,
5    publishableKey: process.env.STRIPE_PUBLISHABLE_KEY,
6  },
7  twilio: {
8    accountSid: process.env.TWILIO_ACCOUNT_SID,
9    authToken: process.env.TWILIO_AUTH_TOKEN,
10  },
11  openai: {
12    apiKey: process.env.OPENAI_API_KEY,
13  }
14};
15
16// Validate that required secrets are set
17for (const [service, keys] of Object.entries(config)) {
18  for (const [key, value] of Object.entries(keys)) {
19    if (!value) {
20      console.warn(`WARNING: ${service}.${key} is not set. Check Secrets panel.`);
21    }
22  }
23}
24
25module.exports = config;

Most APIs use one of three authentication methods: API key as a query parameter, API key in a custom header, or Bearer token in the Authorization header. Set up your HTTP client to include the correct authentication for each API you connect. Using axios, you can create preconfigured instances with default headers so you do not need to pass authentication on every request.

1const axios = require('axios');
2const config = require('./config');
3
4// Method 1: API key in custom header (e.g., OpenAI)
5const openaiClient = axios.create({
6  baseURL: 'https://api.openai.com/v1',
7  headers: {
8    'Authorization': `Bearer ${config.openai.apiKey}`,
9    'Content-Type': 'application/json'
10  }
11});
12
13// Method 2: API key as query parameter
14async function fetchWithKeyParam(endpoint) {
15  const url = `https://api.example.com${endpoint}?api_key=${config.stripe.publishableKey}`;
16  return axios.get(url);
17}
18
19// Method 3: Basic auth (e.g., Twilio)
20const twilioClient = axios.create({
21  baseURL: 'https://api.twilio.com/2010-04-01',
22  auth: {
23    username: config.twilio.accountSid,
24    password: config.twilio.authToken
25  }
26});

This is the most critical step that most users miss. Workspace secrets (the ones you added in step 1) are only available in the development environment. When you deploy your app, you must add the same secrets separately in the Deployments pane. Open the Deployments tab, find the Secrets section, and add each secret again. The values can be different (for example, a live Stripe key instead of a test key). This separation is intentional: it prevents accidentally using test credentials in production.

Before deploying, verify that each API connection works in the development environment. Create a simple test script that calls each API with a minimal request and logs the response status. Run it from the Shell. This catches issues like invalid API keys, incorrect authentication methods, or network restrictions early. If a call fails, check that the secret value is correct and that the API service is not blocking requests from cloud IP addresses.

1// test-connections.js — run with: node test-connections.js
2const config = require('./config');
3const axios = require('axios');
4
5async function testConnections() {
6  console.log('Testing API connections...\n');
7
8  // Test OpenAI
9  try {
10    const res = await axios.get('https://api.openai.com/v1/models', {
11      headers: { 'Authorization': `Bearer ${config.openai.apiKey}` }
12    });
13    console.log(`OpenAI: Connected (${res.data.data.length} models available)`);
14  } catch (err) {
15    console.error(`OpenAI: FAILED - ${err.response?.status || err.message}`);
16  }
17
18  // Add similar tests for each API you use
19}
20
21testConnections();

Many APIs provide separate keys for test and production environments (like Stripe's test vs live keys). Use the REPLIT_DEPLOYMENT predefined environment variable to detect whether your code is running in the workspace or in a deployed environment. This variable is set to 1 in production deployments and is undefined in the workspace. Use this to select the correct configuration, such as Stripe test keys in development and live keys in production. For complex multi-environment setups that require staging environments or advanced credential rotation, RapidDev can help design a secure configuration architecture.

1// config.js — environment-aware configuration
2const isProduction = process.env.REPLIT_DEPLOYMENT === '1';
3
4const config = {
5  stripe: {
6    secretKey: isProduction
7      ? process.env.STRIPE_LIVE_SECRET_KEY
8      : process.env.STRIPE_TEST_SECRET_KEY,
9  },
10  apiBaseUrl: isProduction
11    ? 'https://api.production-service.com'
12    : 'https://api.sandbox-service.com',
13  environment: isProduction ? 'production' : 'development'
14};
15
16console.log(`Running in ${config.environment} mode`);
17module.exports = config;