Secrets

Secrets are the safe place for the sensitive values your app needs — API keys, passwords, and tokens. Unlike an ordinary setting, a secret is encrypted: it's scrambled so it can't be read by anyone snooping, and it's never shown publicly. Your functions can use a secret to do their job without ever exposing it.

Annotated screenshot of the Secrets panel showing secret entries with values masked as dots and a lock/encrypted indicator highlighted, callout: "Secrets are encrypted and kept private."

What it's for

Anything that would cause real harm if a stranger saw it belongs here, not in an environment variable. For example:

• API keys — your key for a payment provider, an email service, or an AI model.
• Passwords and connection details — a database password, a service login.
• Tokens — access tokens that let your app talk to another system.

The rule of thumb: if leaking it could cost you money or let someone impersonate you, store it as a secret.

How it works

Encrypted and kept private

Worried about leaking a key? That's the exact problem secrets solve. When you save a secret, Pikku Studio Cloud encrypts it, displays it masked (as dots), and keeps it private — the value isn't exposed publicly, and it isn't shown back to you in plain text after you save it. Your functions can use a secret while they run to call the outside service without exposing it.

This includes the AI builder. The builder can use a secret you've set — for example, wire your functions to a service that needs that key — without ever exposing the raw value. The sensitive value stays encrypted and private.

If a secret leaks, rotate it

If you ever paste the wrong value, or you think a key has been exposed, you don't have to panic. You simply rotate it — replace the secret with a fresh value from the provider. Update it once in Pikku Studio Cloud, deploy, and every function that uses that secret picks up the new value. The old one stops being used.

Saving or rotating a secret doesn't put anything live on its own. Like all configuration in Pikku Studio Cloud, your change takes effect on your next deploy.

Which one do I use?

If the value is sensitive and you're holding the raw key or password yourself, it's a secret. The quick rule:

• Is it a key, password, or token that must stay private? → Secret — you're in the right place.
• Is it a harmless setting like a label or public URL? → Use an environment variable instead.
• Is it a login to an outside service like Google or Stripe? → Use a credential, which connects the service securely so you don't copy a key by hand at all.

Where to go next

• Credentials — connect outside services with their official login, no key-copying required.
• Environment variables — the plain-text place for non-sensitive, per-stage settings.
• Stages — set a different secret for Production, Development, and Preview.