Glossary / Environment variables and secrets
What are environment variables and secrets?
Environment variables are settings an app reads from where it runs rather than from its code, such as a database address. Secrets are the sensitive ones, like API keys and passwords, which must never be shown to users or committed to code.
Keeping settings outside the code lets the same app run in different places, such as a test copy and the live version, each with its own database and keys.
Secrets are anything that would let someone else act as your app: payment keys, AI provider keys, email service passwords, database passwords. They belong on the server, read from the environment when needed.
The common mistakes are pasting a key into frontend code, where anyone can read it in the browser, or into a file that ends up in a public repository. If a key leaks, revoke it and create a new one straight away.
Mythex lets you add secrets to a project without pasting the key into the chat.
Examples
- STRIPE_SECRET_KEY for payments
- DATABASE_URL for the database connection
- An AI provider's API key
Questions
Can I put an API key in my frontend code?
Only if the provider says that key is meant to be public, such as some map or analytics keys. Secret keys must stay on the server.
What should I do if a secret key leaks?
Revoke or rotate it in the provider's dashboard immediately, update your app with the new key, and check the provider's logs for any misuse.