# Secrets and environment

Use sandbox secrets for configuration that must not be stored in source files or Git history.

## Set runtime secrets

Set one value or several values on a ready sandbox:

```ts
await sandbox.secrets.set('STRIPE_KEY', process.env.STRIPE_KEY!);

await sandbox.secrets.setMany({
  APP_ENV: { value: 'staging', environment: 'development' },
  INTERNAL_API_KEY: process.env.INTERNAL_API_KEY!,
});
```

The default type is `environment_variable`. Supported environments are `development` and `production`.

List operations return metadata such as name, type, environment, and timestamps. They do not return secret values:

```ts
const secrets = await sandbox.secrets.list({ environment: 'development' });

await sandbox.secrets.delete('INTERNAL_API_KEY', {
  environment: 'development',
});
```

Secrets belong to the sandbox whose `secrets` API you use.

## Configure Composer credentials

Composer credentials have their own API because Composer supports multiple credential shapes. Provide credentials during creation or manage them through the sandbox instance:

```ts
await sandbox.composer.credentials.set({
  type: 'github-oauth',
  token: process.env.GITHUB_TOKEN!,
});
```

Supported credential types are `github-oauth`, `gitlab-oauth`, `gitlab-token`, `bitbucket-oauth`, `http-basic`, and `bearer`.

Never print a secret value, place it in a command argument, or include it in a preview URL. See [Security model](/docs/concepts/security) for the wider trust boundary.