Replit Secrets guide

Replit makes it easy to paste a key straight into main.py or index.js. Don't. Use Secrets, and keep them on the server side of your app.

Checked against the Replit docs linked below on October 13, 2026.

Add a secret

1. Open your App and find the Secrets tool (search for it in the tools panel).
2. Add a key such as OPENAI_API_KEY and paste the value.
3. Restart the app so the new value is loaded.

Read it in code

import os
api_key = os.environ["OPENAI_API_KEY"]

const apiKey = process.env.OPENAI_API_KEY;

Failing loudly when a secret is missing (as os.environ[...] does) is better than silently sending requests with an empty key.

Ways secrets still leak on Replit

• Hardcoding during a quick test. If a key was ever in a file, assume it is in history and rotate it.
• Sending it to the browser. If your app has a frontend, never inject a private key into HTML or client JavaScript. Make a server route that calls the API.
• Logging it. print(os.environ) or logging request headers can write secrets to logs you share in screenshots or support threads.
• Agent generated code. Ask Replit Agent or any AI tool to read keys from environment variables, then check its output for literal key strings.
• Deployment config. Make sure your deployment has the secrets it needs, and that you are not passing them in a public URL or query string.

If a key leaked

Revoke or rotate it at the provider, update the value in Secrets, and restart. Then follow the first hour after an API key leaks.

Official docs

• Replit Secrets
• Replit deployment secrets