Secrets are encrypted values stored server-side and injected into edge functions as environment variables. They never reach the browser, never appear in your git history, and never show up in logs.
/When to use one
- 01Third-party API keys: Stripe, OpenAI, SendGrid, anything you'd be embarrassed to leak.
- 02Webhook signing keys: The shared secret you verify incoming webhooks with.
- 03Private URLs: An internal endpoint you'd rather nobody guessed.
Never paste a secret into a prompt
Lovable can add a secret for you through a secure form. Just say "add my STRIPE_SECRET_KEY" — you'll get a text field that stays server-side.