Docs
Deploys and Secrets
Prepare a project for deployment without exposing provider credentials in generated source.
Deployment flow
Deploy requests are available through the /api/v1/deploys route family and the workspace deployment UI. The deploy API accepts provider-scoped requests and exposes provider-specific deploy status lookups.
Secret handling
Project secrets are managed through authenticated project settings routes. Keep provider tokens, database URLs, and webhook secrets in project secret storage instead of hard-coding them into generated files.
Practical checklist
- Name secrets after the environment variables your app reads.
- Keep local development values separate from production values.
- Rotate a secret if it ever appears in generated source, chat output, logs, or screenshots.
- Verify the deployed app from a fresh browser session after changing auth, billing, or webhook credentials.
Related pages
Review /security for vulnerability reporting guidance.