
Description
Manage API keys, credentials, and other secrets in Encore.ts using `secret(...)` from `encore.dev/config`.
SKILL.md
Encore Secrets
Instructions
Secrets are encrypted, environment-scoped values managed by Encore. Declare them at package level by calling secret(name) and read them by calling the returned function.
import { secret } from "encore.dev/config";
// Package-level declaration
const stripeKey = secret("StripeSecretKey");
// Read inside a handler
async function chargeCustomer() {
const key = stripeKey(); // <-- function call returns the value
const stripe = new Stripe(key);
// ...
}
Secret names are globally unique across the application (the same name resolves to the same value everywhere).
Setting values
# Set per environment type
encore secret set --type prod StripeSecretKey
encore secret set --type dev StripeSecretKey
encore secret set --type local StripeSecretKey
Environment types: production (alias prod), development (alias dev), preview (alias pr), local.
Local overrides
For local development without going through encore secret set, create a .secrets.local.cue file at the repo root (gitignore it):
StripeSecretKey: "sk_test_local_..."
GitHubAPIToken: "ghp_local_..."
Common usage patterns
// HTTP headers
const githubToken = secret("GitHubAPIToken");
const resp = await fetch("https://api.github.com/user", {
headers: { Authorization: `token ${githubToken()}` },
});
// Webhook signature verification
const stripeWebhookSecret = secret("StripeWebhookSecret");
stripe.webhooks.constructEvent(rawBody, sig, stripeWebhookSecret());
// Connecting to a third-party SDK
const openaiKey = secret("OpenAIKey");
const openai = new OpenAI({ apiKey: openaiKey() });
Guidelines
- Always declare
secret(...)at package level, never inside functions. - Read with a function call:
stripeKey()notstripeKey. - Set distinct values per environment via
encore secret set --type <env>. - Never commit secret values; use
.secrets.local.cuefor local overrides and gitignore it. - For webhook signature secrets specifically, see also the
encore-webhookskill.
More skills from the skills repository
View all 28 skillsencore-api
build type-safe APIs with Encore
Apr 6API DevelopmentEncoreTypeScriptencore-auth
implement Encore.ts authentication
Apr 6AuthEncoreTypeScriptencore-bucket
store files in Encore.ts buckets
May 16BackendEncoreFile StorageFile Uploads +1encore-cache
cache data in Redis with Encore.ts
May 16BackendCachingEncoreRedis +1encore-code-review
review Encore.ts code
Apr 6Code ReviewEncoreTypeScriptencore-cron
schedule recurring jobs in Encore.ts
May 16AutomationBackendEncoreScheduling +1
More from Encore
View publisherencore-database
build Encore databases
skills
Apr 6DatabaseEncoreORMTypeScriptencore-frontend
connect frontend to Encore backend
skills
Apr 6EncoreFrontendNext.jsReactencore-getting-started
build and run applications with Encore.ts
skills
Apr 6API DevelopmentBackendEncoreLocal Development +2encore-go-api
build APIs with Encore Go
skills
Apr 6API DevelopmentEncoreGoencore-go-auth
implement authentication with Encore Go
skills
Apr 6AuthBackendEncoreGoencore-go-bucket
store files in Encore Go buckets
skills
May 16BackendEncoreFile StorageGo +1