Secrets

Store API keys and sensitive values securely inside your Meku project. Secrets are encrypted, never exposed in your code, and only accessible within the project they belong to.

Use Secrets whenever your project needs to connect to an external service, such as an email provider, payment gateway, or third-party API. Instead of hardcoding sensitive values into your codebase, you store them as Secrets, and Meku injects them at the right place.

Where to Find It

Open your project settings by clicking the gear icon in the top-right corner of the editor. Select Secrets from the left sidebar inside Project Settings.

Adding a Secret

• Enter a name for your secret in the left field.
• Paste the secret value in the right field.
• Click Save Secret.

Secret names can only contain uppercase letters, numbers, and underscores. For example, STRIPE_API_KEY or OPENAI_KEY are valid names. Lowercase letters and special characters are not allowed.

Naming Rules

Secret names follow a strict format:

• Uppercase letters only (A-Z)
• Numbers are allowed (0-9)
• Underscores are allowed as separators
• No spaces, hyphens, or special characters
• No lowercase letters

A name like my-api-key will not save. Use MY_API_KEY instead.

Security Model

Secrets are encrypted and stored securely. The value is masked by default in the project settings panel. Click the eye icon next to a saved secret to reveal the value temporarily.

Meku does not expose secret values in generated code, version history, or project exports. Only the secret name is referenced in code, not the value itself.

Updating or Deleting a Secret

To update a secret, overwrite the value in the field and click Save Secret again. To delete a secret, click the trash icon next to it. Deleting a secret removes it permanently. Any part of your project that referenced that secret will stop working until you add a replacement.

Best Practices

• Rotate secrets regularly, especially if a key was accidentally exposed.
• Use one secret per service. Avoid combining multiple keys into one secret value.
• Name secrets clearly so it's obvious which service they belong to. RESEND_API_KEY is better than KEY1.
• Never paste secret values directly into prompts or the code editor.