How to manage API keys in Replit

In your Replit workspace, locate the Tools dock on the left sidebar. Click Secrets or use the search icon at the top of the sidebar and type Secrets. The Secrets panel opens with two tabs: App Secrets and Account Secrets. App Secrets are scoped to the current project. Account Secrets are available across all your projects but must be explicitly linked before they work in a specific app.

In the App Secrets tab, click the Add Secret button. Enter a key name using uppercase letters and underscores, like OPENAI_API_KEY or STRIPE_SECRET_KEY. Paste your actual API key into the value field. Click Add Secret to save. The value is immediately encrypted and stored. You can edit or delete secrets at any time from this panel. For bulk editing, click the three-dot menu and select Edit as JSON or Edit as .env to paste multiple key-value pairs at once.

Replit injects secrets as standard environment variables. In Node.js, use process.env.YOUR_KEY_NAME. In Python, use os.getenv('YOUR_KEY_NAME') or os.environ['YOUR_KEY_NAME']. The values are available immediately at runtime without importing any Replit-specific library. Never log secret values to the console or return them in API responses. If you add a new secret while the app is running, you may need to stop and re-run the app for the new value to appear.

1// Node.js
2const apiKey = process.env.OPENAI_API_KEY;
3if (!apiKey) {
4  throw new Error('OPENAI_API_KEY is not set. Add it in Tools > Secrets.');
5}
6
7# Python
8import os
9api_key = os.getenv('OPENAI_API_KEY')
10if not api_key:
11    raise ValueError('OPENAI_API_KEY is not set. Add it in Tools > Secrets.')

Switch to the Account Secrets tab in the Secrets panel. Add a secret here the same way you added an App Secret. Account Secrets are stored at your account level and are not automatically available in any project. To use one, go back to the App Secrets tab, click Link Account Secret, and select the secret you want to connect. This creates a reference rather than a copy, so updating the Account Secret updates it everywhere it is linked. This is ideal for keys you use across many projects, like a shared OpenAI or Stripe API key.

Replit applies different visibility levels depending on the viewer's relationship to the project. Collaborators who are invited to your project can see both secret names and values. Cover page visitors who simply view your project's public page see nothing about your secrets. Remixers who fork your project see the secret key names but not the values, which means they know which secrets to set up but cannot access your actual credentials. Organization members without the Owner role cannot view secret values in the UI but can print them from code if they have edit access.

This is the single most important step and the most common source of deployment failures. Workspace secrets do not automatically transfer to deployed apps. Open the Deployments pane, navigate to Settings or Configuration, and add every secret your production app needs. Without this step, process.env.YOUR_KEY will return undefined in production even though it works perfectly in development. Static deployments do not support secrets at all, so only Autoscale, Reserved VM, and Scheduled deployment types can use them.

After adding or changing secrets, you can verify they are available from the Shell. However, Shell access to environment variables requires a reboot of the Replit environment. Run kill 1 in the Shell to restart the environment, then use echo $YOUR_KEY_NAME to confirm the value is loaded. Be cautious with this approach in shared workspaces since the value will be visible in the terminal output. For a safer check, write a small script that prints a masked version of the key, showing only the first and last few characters.

1# Restart environment to load new secrets
2kill 1
3
4# After restart, verify (be careful in shared workspaces)
5echo $OPENAI_API_KEY
6
7# Safer: use a script to mask the value
8node -e "const k = process.env.OPENAI_API_KEY; console.log(k ? k.slice(0,4) + '...' + k.slice(-4) : 'NOT SET')"