Secrets

Secrets are the app's encrypted environment variables, for third-party credentials the platform SDK does not already handle: a Stripe key, a signing secret, a direct external API. Each key holds separate dev and prod values, injected as process.env into method execution and resolved by context, so the same code reads test keys in the sandbox and live keys in production. list shows which keys exist and which environments each has a value in, without revealing anything.

get returns the decrypted dev and prod values and is logged as a reveal event on the workspace audit log. set writes with merge semantics: update either environment independently, with flags to clear one without touching the other. delete removes a key entirely, and any write invalidates active sandboxes so they reprovision with the new values.