Environment variables
Keep API keys and secrets out of your code, and set the right values for production
Some values your app needs should never live in your source code, such as API keys, database passwords, and connection details. These are configured as environment variables, so they can differ between development and production and stay out of your files.
Public configuration and secrets
Not all configuration is sensitive. It helps to keep two categories in mind:
- Public configuration is safe to expose in the browser, such as a public site URL or a public key intended for client use.
- Secrets must never be exposed to the browser or committed to source, such as API keys, database passwords, and private tokens.
A value is not secret just because it lives in an environment variable. Anything sent to the browser can be read by users. Keep private keys and passwords in server-side configuration only, and never place them in client-side code or public documentation.
Using environment variables in PlutoAI
When a feature needs a key or a connection detail, tell the agent which value to use and how it should be used.
Use the STRIPE_SECRET_KEY environment variable for server-side payment calls, and do not expose it to the browser.
Provide the actual values through configuration rather than pasting secrets into the conversation where they are not needed.
Development and production
The values you use while building are often different from the values you use in production. Before you deploy, make sure the production values are set for the live environment.
See Deploy your app for the checklist before you go live.