Docs - Publishing and ownership
Environment variables and secrets
Keep API keys and production secrets out of prompts and exports.
Secrets should live in your production host or provider dashboards, not in public pages, prompt text, or exported zip files. DriftLess can prepare code paths, but real secret management is a production responsibility.
Checklist
- 1Identify which services need keys or tokens.
- 2Store production values in your host environment settings.
- 3Use placeholder names in documentation and handoff notes.
- 4Rotate secrets if they were exposed accidentally.
Keep in mind
- Never paste production secrets into public support threads.
- Downloaded files should not contain live secret values.
- External services may require separate account setup.
environment variableswebsite secretsAPI key safety
Last reviewed: 2026-06-01