> ## Documentation Index > Fetch the complete documentation index at: https://docs.base44.com/llms.txt > Use this file to discover all available pages before exploring further. # Managing app secrets > Store API keys, tokens, and passwords as app secrets so your backend functions can use them. Add a key or paste it in the AI chat, then change or delete it. Secrets are where your app keeps API keys, tokens, and passwords, so its backend functions can use them without the values ever showing up in your app's code. You add, change, and delete them from the **Secrets** page in your app's dashboard, or paste a key into the AI chat and Base44 saves it for you. > [!NOTE] > > The **Secrets** page appears in your dashboard once your app uses backend functions. *** ## Getting an API key An API key acts like a private password between your app and an external service. It proves the account is yours and keeps the connection secure. You create the key in the service itself, then add it to your app. > [!WARNING] > > Never share your API key publicly. Treat it like a password. **To get an API key:** 1. Sign in to the external service, for example OpenAI, Resend, or Stripe. 2. Open its **Developer**, **API**, or **Integrations** section. 3. Create a new API key or token. 4. Copy the key. 5. Add the key to your app as a secret. You can [add it on the Secrets page](#adding-secrets) or [paste it into the AI chat](#pasting-keys-in-chat). *** ## Adding secrets Add a secret when a service gives you a key your app needs. If the AI chat needs a key, it shows a form where you can enter it, and the key is saved as a secret for you. Your backend functions find each secret by its exact name. If the AI chat already wrote a function that expects a key, use the name it gave you. ![The AI chat's Action needed card asking for a RESEND\_API\_KEY secret, with Skip and Submit Secrets buttons](https://mintcdn.com/base44/nv1IVmq8CgUm8kOS/images/chataiapi.png?fit=max\&auto=format\&n=nv1IVmq8CgUm8kOS\&q=85\&s=f424f38d37b23f20d56314a9c0a9d067) The AI chat asking for a secret **To add a secret:** 1. Go to your app editor. 2. Click **Dashboard**. 3. Click **Secrets**. 4. Click **Add Secret**. 5. Enter the **Secret Name**, for example `STRIPE_API_KEY`. Names can't contain spaces, so use underscores. 6. Paste the key into **Secret Value**. 7. Click **Add Secret**. ![Application Secrets page with Secrets outlined in the sidebar and 4 masked secrets](https://mintcdn.com/base44/md0uEgmxEQCB9Nzh/images/apikeys.png?fit=max\&auto=format\&n=md0uEgmxEQCB9Nzh\&q=85\&s=38737506f2d314b714dcc48fbfea347c) Your app's saved secrets > [!TIP] > > To add several secrets at once, click **Import .env** instead of **Add Secret**, then upload or paste your `.env` file. Each `KEY=VALUE` line becomes a secret, and an existing secret with the same name gets the new value. *** ## Pasting keys in chat When you paste an API key into a message in the AI chat, Base44 saves it as a secret for you and takes it out of the message before the AI reads it. This happens in every chat mode, and the AI works with the secret's name, never the key itself. In your message, the key is replaced with a line that starts with "Secret detected and saved as" and gives the secret's name, such as `$STRIPE_SECRET_KEY`. The secret then appears on the **Secrets** page, where you can change or delete it like any other secret. Base44 recognizes keys from OpenAI, Anthropic, Stripe, AWS, GitHub, Google, and Slack, bot tokens from Telegram and Discord, and JSON Web Tokens. For keys from other services, [add them as secrets yourself](#adding-secrets) instead of pasting them into the chat. *** ## Changing or deleting secrets Update a secret when you regenerate a key in the service it comes from, and delete it when your app no longer uses that service. Choose what you want to do: > [accordion] Change a secret's value > > You can replace a secret's value, but you can't rename it. To use a different name, add a new secret and delete the old one. > > **To change a secret's value:** > > 1. Go to your app editor. > 2. Click **Dashboard**. > 3. Click **Secrets**. > 4. Click the edit icon next to the secret. > 5. Paste the new value. > 6. Click **Save**. > [accordion] Delete a secret > > Deleting happens straight away, with no confirmation, and you can't undo it. A function that still reads the secret gets no value, so ask the AI chat to remove or update that code too. > > **To delete a secret:** > > 1. Go to your app editor. > 2. Click **Dashboard**. > 3. Click **Secrets**. > 4. Click the delete icon next to the secret. *** ## Applying your changes When you add, change, or delete a secret, your backend functions pick up the change automatically while you build and preview. Your published app can keep the values it had when you last published, so publish your app again to make sure your live app uses the change. *** ## Keeping secrets private Secrets are encrypted and stored securely, and they stay on the server. Your backend functions read them when they run, so the full secret values never reach the browser or the people using your app. After you save a secret, its full value stays hidden, even from you. When you save a value of 30 characters or more, such as most API keys, the **Secrets** page shows its first 10 characters, so you can tell which key is saved. Shorter values stay fully masked. Anyone who can edit your app can see these hints and add, change, or delete its secrets. Keep your own copy of any key you can't regenerate. > [!TIP] > > **Other places to keep keys:** > > * **Shared APIs:** App secrets belong to one app. To share one API and its credentials with every app in your workspace, use a [custom OpenAPI integration](https://docs.base44.com/documentation/integrations/using-custom-integrations.md). > * **Your own code:** If you write backend functions yourself, see [reading secrets in code](https://docs.base44.com/developers/backend/resources/backend-functions/overview.md#read-secrets). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.