Secrets

What Secrets is for

Some values should never sit in plain environment variables: payment API keys, signing tokens, third-party database passwords. Secrets is the platform's encrypted store for exactly those values. You create a secret once per project, and the platform keeps it encrypted at rest, shows it only when you explicitly ask, and injects it into the apps you choose as a normal environment variable.

Plain environment variables remain the right place for non-sensitive configuration (feature flags, public URLs, log levels). In fact, the dashboard rejects env keys that look secret-like — names containing markers such as SECRET, TOKEN, or API_KEY belong here instead.

Credentials for managed databases don't need Secrets at all: linking a database already injects DATABASE_URL / REDIS_URL for you, and you never handle those passwords by hand.

Where Secrets lives

Secrets is a top-level item in the dashboard sidebar. Open it to see every secret across your projects — its name, project, how many apps it is attached to, and when it last changed. Values are never shown in the list.

Creating a secret

Click New secret and fill in:

• Project: the project the secret belongs to. Only apps in that same project can use it.
• Name: a lowercase identifier (letters, digits, and dashes, 2–63 characters), for example stripe-api-key. The name is validated as you type.
• Value: the sensitive value itself, up to 64 KiB. A byte counter under the field shows how much room is left.
• Description (optional): a note for your future self about what the value is and where it came from.

A project can hold up to 100 secrets. The name must be unique within the project.

Attaching a secret to an app

Creating a secret stores it — attaching it is what delivers it to a running app. On a container app's page, the Secrets card lists what is already attached and lets you attach more:

1. Click Attach secret and pick one of the project's secrets.
2. Choose the environment variable name your code reads, for example STRIPE_API_KEY. The dialog suggests one derived from the secret's name; names must be UPPER_SNAKE_CASE and can't collide with an existing variable or a platform-injected one.
3. Confirm. The platform wires the value into the app and re-rolls it, so the variable is present on the next start.

Your code just reads the environment variable — nothing platform-specific. Attached names also appear as read-only entries in the app's environment editor, so they can't be overwritten by a plain env var with the same name.

Detaching works from the same card. The variable disappears from the app on its next roll.

Revealing a value

From the Secrets page, Reveal shows a secret's stored value (masked until you click Show, with one-click copy). Reveals are deliberately repeatable — this is your store, you can always read it back.

Every reveal is recorded in your project's activity log, so there is an audit trail of who looked at what, and when.

Rotating a value

Editing a secret's value is a rotation: the new value is saved, and every app the secret is attached to is restarted automatically so running processes pick up the new value. Apps read environment variables at start, so without the restart they would keep the old value — the platform handles that for you.

If the new value can't be delivered to your apps right away, the API tells you explicitly instead of pretending it worked — retry the update and it converges.

Deleting a secret

A secret that is still attached to an app can't be deleted — the dashboard tells you how many apps still use it. Detach it everywhere first, then delete. This means you can never silently break a running app by removing a value it depends on.

Pricing

Secrets are currently a free preview. Creating, storing, revealing, updating, attaching, or detaching a secret does not debit your balance today. If metered pricing is introduced later, the rate card and this page will be updated before charging begins.

Automation (API)

Everything above is available on the REST API for scripting. The main endpoints, all under your project:

# create a secret
curl -X POST https://api.alawadi.cloud/v1/projects/$PROJECT_ID/secrets \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name": "stripe-api-key", "value": "sk_live_...", "description": "Stripe live key"}'

# attach it to a container app as STRIPE_API_KEY
curl -X POST https://api.alawadi.cloud/v1/projects/$PROJECT_ID/containers/$CONTAINER_ID/secrets \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"secret_id": "<secret-id>", "env_name": "STRIPE_API_KEY"}'

# read the value back (recorded in the activity log)
curl -X POST https://api.alawadi.cloud/v1/projects/$PROJECT_ID/secrets/$SECRET_ID/reveal \
  -H "Authorization: Bearer $TOKEN"

The full request and response shapes, including every error code, are in the Secrets API reference.