> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thebay.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> The only thing Bay ever asks you for.

Bay reads your code. It does not read your credentials — those are the one input
that cannot be inferred, and the only thing it will ever ask for.

## Declare the names, supply the values

Names live in the config, committed:

```json theme={null}
{
  "services": [
    { "name": "app", "secrets": ["STRIPE_SECRET_KEY", "OPENAI_API_KEY"] }
  ]
}
```

Values are set out of band and stored in Secret Manager:

```bash theme={null}
bay env my-app set STRIPE_SECRET_KEY=sk_live_...
```

<Check>
  A name declared in `secrets` and missing at deploy time fails **before the
  build**, not at runtime. That is the whole reason the names are declared: an
  absent credential is a build error, not a 500 at 3am.
</Check>

## What is not a secret

|                           | Where                    |                                                                                           |
| ------------------------- | ------------------------ | ----------------------------------------------------------------------------------------- |
| `NODE_ENV`, `LOG_LEVEL`   | `env` in the config      | Committed. Deploy-shaping, and visible in review.                                         |
| `VITE_*`, `NEXT_PUBLIC_*` | `buildEnv` in the config | Baked into the bundle at build time. Setting them later means the build ran without them. |

## Secrets Bay generates for you

A provisioned database's credentials are never yours to type. Bay creates the
role, stores the connection string, and injects it under every name your stack is
likely to read — `DATABASE_URL`, `POSTGRES_PASSWORD`, `PGPASSWORD` and others —
so an ORM's default configuration works without being told anything.

## Carrying a local .env up

```bash theme={null}
bay ship              # sets variables your app does not have yet
bay ship --no-env     # carries nothing
```

<Warning>
  `--no-env` is the right flag for a repository whose `.env` holds someone else's
  credentials, or a production key you did not mean to move.
</Warning>