Store and rotate application secrets

Add a secret

Open the project Secrets page, choose the intended environment scope, enter a supported name and submit the value once. BlinkHost stores an encrypted reference and never returns the plaintext value through the normal API.

Use it in a backend module

Reference the secret by name from a backend module capability that permits secret access. Public frontend prefixes such as PUBLIC_ and NEXT_PUBLIC_ are not accepted as private backend secrets. Secret values are never injected into browser JavaScript.

For LiveStack, create a development- or preview-scoped value and start an isolated preview session. LiveStack does not fall back to a production secret when the preview value is missing. A module that needs no secret can run without one.

Rotate safely

Create a new version, deploy the project so the immutable production payload selects it, verify the dependent operation and only then revoke the old provider credential. Preview and production references are independent, so test with a non-production credential before promotion.

Never paste a database or provider connection string into documentation feedback, logs, analytics, source code, browser screenshots or support messages.