Single-value secrets

A named value that lives in an environment, with a fixed type and a version for every change you can reveal and roll back.

Updated Sep 17, 2026

A single-value secret is one named value — an API key, a connection string, a token — that lives in an environment. It has a name (the environment-variable name your application reads it as), a type that fixes what the value looks like, and a new version every time you change it. Secrets that hold several values at once are structured secrets, and decoy secrets are canaries; both are covered on their own pages.

Create a secret#

  1. In an environment, select the + at the top right of the secrets table and choose Single-value.

  2. Pick the value's type. String accepts anything and is the default; the other types are checked when you save. See Secret types for the full list.

  3. Name it. The name is shaped into SCREAMING_SNAKE as you type — the form your application reads it as, like DATABASE_URL — so you can type it however is natural.

  4. Enter the value — or generate one, for the types that support it — and create. To put the same value in the other stages at once, tick them under Also set in.

The value box matches the type: a plain field or a larger box for text and documents, a true/false picker for a boolean, and a generator for passwords, tokens, and keys.

Reveal a value#

The list shows each secret's name, type, and current version, with the value masked. Select the eye to Reveal the current value. Every reveal is recorded in your audit log.

Change the value#

Edit value saves a new version and keeps the old ones — a value is never overwritten, only added to. A secret's type is set when it is created and does not change; its name changes with Rename.

Versions#

Version History lists every version with who set it and when. From there you can reveal an earlier version or revert to it, which brings that value back as a new version so nothing is lost.

Rename, copy, and delete#

Rename changes the secret's name in every environment at once — the name belongs to the project, not to one stage. Copy slug copies its project/env/NAME address for pasting into code or an SDK. Delete removes the value in the environment you are in.