Keys and secrets — set once, never shown back

First, tell secret from not secret

A value nobody can harm you with, such as a time zone, a shop name or the app's mode, is ordinary configuration, and your AI can set it. A value someone could use if it leaked, such as a Stripe secret key, an OpenAI API key or a LINE channel secret, is a secret. You enter those yourself, and your AI should never see them.

1. Ordinary values: your AI can set them

Say it in the chat, for example “set TIMEZONE to Asia/Bangkok for this app”, or run it in a terminal.

Once they are set, the app restarts with them. They are stored encrypted. To see which variables exist, this shows names only, never values, so it is safe on a shared screen.

2. Secrets: entered in the console, not in the chat

Never paste a key into a chat with your AI. Give your AI only the key's name, and enter the value yourself.

Once your AI declares the name at deploy, Erawan holds the app before its first start and sends back a link to the app's secrets page in the console. Open it, paste the key and save, and the app carries on starting by itself. The value never passes through the chat or your AI, and never goes into the build.

Once saved, it cannot be read back from anywhere: not the console, the terminal commands, the API or your AI. It can only be replaced or deleted, so keep the original at the provider or in your password manager.

If the key is already in a file on your computer and you have a terminal open, you can use this instead. The name has to be declared at deploy first. You type the value at a hidden prompt, then confirm in your browser.

3. If a key ends up in your code

Before every build, Erawan reads the code for keys that look real: AWS, Google, Stripe and Slack keys, private keys, a password or API key written into the source, and a .env file with values in it. Finding one stops the deploy there, and your AI is told which file to fix.

It stops rather than warns because a leaked key can be used by a stranger while the bill goes to you.

Test files, example files and documentation are not checked, and a value that is plainly a placeholder, such as your-key-here or changeme, passes.

To find out before you put it online, run this. It runs the same check without deploying.

If a deploy has already stopped, When a build fails walks through the fix.

What is still yours

A key that leaked, or one held by someone who has left the team, has to be replaced at the provider, and the new value set in Erawan. Who in your app may see what is for your code to decide. Erawan can hold a key, but it cannot decide what your app should do with it.