Secrets and environment values

Real sites talk to other services — payments, email, maps, AI models — and those services authenticate with keys. Secrets are how you give your project those keys without pasting them into chat or hard-coding them into the site.

Adding a secret

1. Open your project workspace and go to Tools, then Secrets.
2. Add a name (for example STRIPE_SECRET_KEY) and the value.
3. Tell the agent what the key is for in plain language — "use my Stripe key for checkout" — and it wires the code to read the secret by name.

Values are stored encrypted in your project's backend. The agent reads a secret when it runs your code, but a secret's value is never printed into the chat, the code it writes, or the published site's visible output.

Rules that keep secrets safe

• One secret per key, named after what it unlocks — never bundle several keys into one value.
• If a key ever appears in a chat, screenshot, or public place, treat it as exposed: rotate it at the provider, then update the secret here.
• Deleting a secret takes effect immediately; code that reads it will fail until you add a replacement.

Project secrets vs your account

Project secrets belong to the site being built: its Stripe key, its email provider key, and anything else the code needs at runtime. Your Black Whole account is separate. Builds run on Black Whole's own hosted models using your monthly credits, so building a site never requires a secret of any kind. Add project secrets only when the site you are building actually calls an outside service.