How to store secrets safely in Replit

In your Replit workspace, locate the Tools dock on the left sidebar. Click on Secrets to open the panel. If Secrets is not visible in the dock, click the search icon at the top of the sidebar and type Secrets. The Secrets panel has two tabs: App Secrets (specific to the current Repl) and Account Secrets (available across all your Repls, but must be linked to individual apps before use). For most use cases, you will use App Secrets.

In the App Secrets tab, click the plus button or the Add Secret button. Enter a key name using uppercase letters and underscores (this is a convention, not a requirement). For example: OPENAI_API_KEY, DATABASE_URL, or STRIPE_SECRET_KEY. Paste the secret value in the value field. Click Add Secret. The value is immediately encrypted with AES-256 encryption and stored securely. You can add as many secrets as your project needs. Each secret is a key-value pair that becomes an environment variable at runtime.

Secrets are injected as standard environment variables at runtime. Access them using the native environment variable API for your programming language. In Node.js, use process.env.KEY_NAME. In Python, use os.getenv('KEY_NAME') or os.environ['KEY_NAME']. The difference in Python: os.getenv returns None if the variable is missing, while os.environ raises a KeyError. For production code, always check that the value exists before using it to avoid runtime crashes.

1// Node.js
2const apiKey = process.env.OPENAI_API_KEY;
3if (!apiKey) {
4  throw new Error('OPENAI_API_KEY is not set. Add it in Tools > Secrets.');
5}
6
7// Python
8import os
9api_key = os.getenv('OPENAI_API_KEY')
10if not api_key:
11    raise ValueError('OPENAI_API_KEY is not set. Add it in Tools > Secrets.')
12
13// Rust
14let api_key = std::env::var("OPENAI_API_KEY").expect("OPENAI_API_KEY not set");
15
16// Go
17apiKey := os.Getenv("OPENAI_API_KEY")
18
19// Ruby
20api_key = ENV["OPENAI_API_KEY"]
21
22// Java
23String apiKey = System.getenv("OPENAI_API_KEY");

This is the most critical step that most users miss. Workspace secrets are only available in the development environment when you click Run. When you deploy your app (Autoscale, Reserved VM, or Scheduled), you must add the same secrets separately in the Deployments pane. Open the Deployments tab, find the Secrets section, and add each secret. The values can differ between workspace and deployment (for example, test keys vs production keys). If you skip this step, process.env.KEY_NAME returns undefined in the deployed app, which is the number one cause of deployment failures on Replit.

When migrating from another platform or adding many secrets at once, use the bulk editing feature. In the Secrets panel, click Edit as JSON to enter secrets in JSON format or Edit as .env to paste a standard .env file format. The JSON format accepts an object with key-value pairs. The .env format accepts KEY=VALUE lines, one per line. This is much faster than adding secrets one at a time, especially when migrating from a local development setup that uses .env files.

1// JSON format for bulk entry
2{
3  "OPENAI_API_KEY": "sk-abc123",
4  "DATABASE_URL": "postgresql://user:pass@host:5432/db",
5  "STRIPE_SECRET_KEY": "sk_test_xyz789",
6  "JWT_SECRET": "your-jwt-secret-here"
7}
8
9// .env format for bulk entry
10OPENAI_API_KEY=sk-abc123
11DATABASE_URL=postgresql://user:pass@host:5432/db
12STRIPE_SECRET_KEY=sk_test_xyz789
13JWT_SECRET=your-jwt-secret-here

Different users see different levels of secret information. Collaborators with edit access can see both secret names and values. Cover page visitors (anyone viewing your public Repl) see nothing from the Secrets panel. Users who fork (remix) your Repl see secret names but not values, so they know which secrets to add but cannot access your credentials. Organization members without the Owner role cannot view values in the UI but can print them via code. Understanding these rules is essential for teams. For enterprise teams with complex access control requirements, RapidDev can help implement granular permission systems.

Replit automatically sets several environment variables you can use in your code without adding them to Secrets. REPLIT_DEPLOYMENT is set to 1 in deployed apps (undefined in workspace). REPLIT_DOMAINS contains your app's domain. REPL_ID is the unique identifier for your Repl. REPL_SLUG is the project name. REPL_OWNER is the username. REPLIT_DB_URL is the connection string for Replit DB. Important: REPLIT_DEV_DOMAIN exists only in the workspace and is NOT available in deployments. Do not rely on it for production logic.

1// Check predefined variables
2console.log('Deployment:', process.env.REPLIT_DEPLOYMENT || 'workspace');
3console.log('Domain:', process.env.REPLIT_DOMAINS);
4console.log('Repl ID:', process.env.REPL_ID);
5console.log('Owner:', process.env.REPL_OWNER);
6console.log('Slug:', process.env.REPL_SLUG);
7
8// Use REPLIT_DEPLOYMENT for environment detection
9const isProduction = process.env.REPLIT_DEPLOYMENT === '1';