Secrets and environment

Use sandbox secrets for configuration that must not be stored in source files or Git history.

Set runtime secrets

Set one value or several values on a ready sandbox:

const stripeKey = process.env.STRIPE_KEY;
const internalApiKey = process.env.INTERNAL_API_KEY;
if (!stripeKey || !internalApiKey) throw new Error('Sandbox secrets are required');

await sandbox.secrets.set('STRIPE_KEY', stripeKey);

await sandbox.secrets.setMany({
  APP_ENV: { value: 'staging', environment: 'development' },
  INTERNAL_API_KEY: internalApiKey,
});

The default type is environment_variable. Supported environments are development and production.

List operations return metadata such as name, type, environment, and timestamps. They do not return secret values:

const secrets = await sandbox.secrets.list({ environment: 'development' });

await sandbox.secrets.delete('INTERNAL_API_KEY', {
  environment: 'development',
});

Secrets belong to the sandbox whose secrets API you use.

Configure Composer credentials

Composer credentials have their own API because Composer supports multiple credential shapes. Provide credentials during creation or manage them through the sandbox instance:

const githubToken = process.env.GITHUB_TOKEN;
if (!githubToken) throw new Error('GITHUB_TOKEN is required');

await sandbox.composer.credentials.set({
  type: 'github-oauth',
  token: githubToken,
});

Supported credential types are github-oauth, gitlab-oauth, gitlab-token, bitbucket-oauth, http-basic, and bearer.

Never print a secret value, place it in a command argument, or include it in a preview URL. See Security model for the wider trust boundary.