Skip to main content
Secrets, in Security, keeps the private keys your website uses, like the key for a map service, out of its code. Your websites read each secret by its name, and one list serves all your foundable’s websites. Most of the time, Ted asks you for a key on a card in the chat. Type the value and press Set, or Replace for one you saved before. When he works in Run, he asks under Ted needs you instead, and you add the key here. See Answer what Ted asks you. Only the owner and admins can add or change secrets. Members see their names.
1

Open Secrets

In Build, press Tools, then Security, then Secrets. Each row shows a secret’s name, the last few characters of its value, and when it last changed.
Security’s Secrets on a phone: two secret keys listed by name, their values hidden but for the last four characters, under Add secret.
2

Press Add secret

Press Add secret. A new row opens with Name and Value.
3

Name it and paste the value

Use the name your website’s code expects, like GOOGLE_MAPS_API_KEY. A name uses letters, digits, _ or $, and can’t start with a digit. Paste the key into Value. A Stripe secret or restricted key can’t go here: Payments takes payments for you.
4

Press Save

Press Save. Your websites use the key from their next request, the preview included.

​
Change or delete a secret

Press … beside a secret, then Replace to save a new value under the same name, or Delete to remove it. Delete asks first, and you can’t undo it. A change reaches your websites on their next request, in the preview and on the published site, with no rebuild.

​
Check that it worked

A note confirms you saved it, and the list shows the secret’s name.

​
If something goes wrong

A name starting with VITE_ would be visible to every visitor. Use a name without VITE_.
Names that start with SUPABASE_ or FOUNDABLE_ are Foundable’s own, and so are PUBLIC_SUPABASE_URL and PUBLIC_SUPABASE_PUBLISHABLE_KEY. Use another name.
Your secrets are too big all together. Delete one you don’t use, or save a shorter value.

​
FAQ

No. Once you save a value, no one sees it again: not you, your team or Ted. Ted and Build see only the names, and only your websites’ server code reads the values.
Foundable sets them to connect your website to its database: SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY and SUPABASE_SERVICE_ROLE_KEY. To replace the server key, SUPABASE_SERVICE_ROLE_KEY, press … beside it, then Rotate. Foundable asks first, then makes a new key: your website uses it from its next request, and the old one stops working. If a rotation fails or doesn’t finish, the old key keeps working: press Rotate again.
Yes. Your website’s AI runs on your credits. To have OpenAI bill you instead, add a secret named OPENAI_API_KEY. See Use your own OpenAI key.

Find and fix security problems

Scan your website for leaked keys.

Check your website’s AI and limit its spending

Use Foundable AI, or your own OpenAI key.

Answer what Ted asks you

Add a key Ted asks for while he works in Run.