app-secretslisted

# App Secrets Secrets are encrypted key-value pairs stored in Fusebase and injected into the app backend at runtime as environment variables. Use them for sensitive config that must not be committed to source control (API keys, passwords, tokens, etc.). **Secrets are only available in the app server** (`backend/` directory). They are NOT accessible in the browser/SPA — never try to read secrets from the frontend. ## Creating Secrets Use the CLI to register secret keys (values are set on the FuseBase website): ```bash fusebase secret create --app <appId> --secret "KEY:description" [--secret ...] ``` - `appId` — get it from `fusebase.json` (`apps[].id`); `--feature` is accepted as a deprecated alias for `--app` - Each `--secret` is `KEY` or `KEY:human-readable description` - Pass multiple `--secret` flags to create several secrets at once - After running, the CLI prints the URL where you can fill in the actual values **Examples:** ```bash # Single secret fusebase secret create --app abc123 --secret "OPENAI_API_KEY:OpenAI API key" # Multiple secrets at once fusebase secret create --app abc123 \ --secret "STRIPE_SECRET_KEY:Stripe secret key" \ --secret "DB_PASSWORD:Database connection password" \ --secret "WEBHOOK_SECRET:Webhook signing secret" ``` After running, open the printed URL and fill in the secret values. ## Accessing Secrets at Runtime Secrets are injected as environment variables into the app backend process. Read them via `process.env`: ```typescrip