Skip to main content
Secrets are where your app keeps API keys, tokens, and passwords, so its backend functions can use them without the values ever showing up in your app’s code. You add, change, and delete them from the Secrets page in your app’s dashboard, or paste a key into the AI chat and Base44 saves it for you.
The Secrets page appears in your dashboard once your app uses backend functions.

​
Getting an API key

An API key acts like a private password between your app and an external service. It proves the account is yours and keeps the connection secure. You create the key in the service itself, then add it to your app.
Never share your API key publicly. Treat it like a password.
To get an API key:
  1. Sign in to the external service, for example OpenAI, Resend, or Stripe.
  2. Open its Developer, API, or Integrations section.
  3. Create a new API key or token.
  4. Copy the key.
  5. Add the key to your app as a secret. You can add it on the Secrets page or paste it into the AI chat.

​
Adding secrets

Add a secret when a service gives you a key your app needs. If the AI chat needs a key, it shows a form where you can enter it, and the key is saved as a secret for you. Your backend functions find each secret by its exact name. If the AI chat already wrote a function that expects a key, use the name it gave you.
The AI chat's Action needed card asking for a RESEND_API_KEY secret, with Skip and Submit Secrets buttons

The AI chat asking for a secret

To add a secret:
  1. Go to your app editor.
  2. Click Dashboard.
  3. Click Secrets.
  4. Click Add Secret.
  5. Enter the Secret Name, for example STRIPE_API_KEY. Names can’t contain spaces, so use underscores.
  6. Paste the key into Secret Value.
  7. Click Add Secret.
Application Secrets page with Secrets outlined in the sidebar and 4 masked secrets

Your app's saved secrets

To add several secrets at once, click Import .env instead of Add Secret, then upload or paste your .env file. Each KEY=VALUE line becomes a secret, and an existing secret with the same name gets the new value.

​
Pasting keys in chat

When you paste an API key into a message in the AI chat, Base44 saves it as a secret for you and takes it out of the message before the AI reads it. This happens in every chat mode, and the AI works with the secret’s name, never the key itself. In your message, the key is replaced with a line that starts with “Secret detected and saved as” and gives the secret’s name, such as $STRIPE_SECRET_KEY. The secret then appears on the Secrets page, where you can change or delete it like any other secret. Base44 recognizes keys from OpenAI, Anthropic, Stripe, AWS, GitHub, Google, and Slack, bot tokens from Telegram and Discord, and JSON Web Tokens. For keys from other services, add them as secrets yourself instead of pasting them into the chat.

​
Changing or deleting secrets

Update a secret when you regenerate a key in the service it comes from, and delete it when your app no longer uses that service. Choose what you want to do:
You can replace a secret’s value, but you can’t rename it. To use a different name, add a new secret and delete the old one.To change a secret’s value:
  1. Go to your app editor.
  2. Click Dashboard.
  3. Click Secrets.
  4. Click the edit icon next to the secret.
  5. Paste the new value.
  6. Click Save.
Deleting happens straight away, with no confirmation, and you can’t undo it. A function that still reads the secret gets no value, so ask the AI chat to remove or update that code too.To delete a secret:
  1. Go to your app editor.
  2. Click Dashboard.
  3. Click Secrets.
  4. Click the delete icon next to the secret.

​
Applying your changes

When you add, change, or delete a secret, your backend functions pick up the change automatically while you build and preview. Your published app can keep the values it had when you last published, so publish your app again to make sure your live app uses the change.

​
Keeping secrets private

Secrets are encrypted and stored securely, and they stay on the server. Your backend functions read them when they run, so the full secret values never reach the browser or the people using your app. After you save a secret, its full value stays hidden, even from you. When you save a value of 30 characters or more, such as most API keys, the Secrets page shows its first 10 characters, so you can tell which key is saved. Shorter values stay fully masked. Anyone who can edit your app can see these hints and add, change, or delete its secrets. Keep your own copy of any key you can’t regenerate.
Other places to keep keys: