Skip to main content
Bay reads your code. It does not read your credentials — those are the one input that cannot be inferred, and the only thing it will ever ask for.

​
Declare the names, supply the values

Names live in the config, committed:
Values are set out of band and stored in Secret Manager:
A name declared in secrets and missing at deploy time fails before the build, not at runtime. That is the whole reason the names are declared: an absent credential is a build error, not a 500 at 3am.

​
What is not a secret

​
Secrets Bay generates for you

A provisioned database’s credentials are never yours to type. Bay creates the role, stores the connection string, and injects it under every name your stack is likely to read — DATABASE_URL, POSTGRES_PASSWORD, PGPASSWORD and others — so an ORM’s default configuration works without being told anything.

​
Carrying a local .env up

--no-env is the right flag for a repository whose .env holds someone else’s credentials, or a production key you did not mean to move.