Secrets — Nubes Docs

Reference a secret

Use a secret block to declare a value by name. The infrastructure file contains the reference, not the credential itself.

nubes.hcl

version = 1

secret "STRIPE_API_KEY" {}

app "api" {
  source "nodejs" {
    path            = "./api"
    package_manager = "pnpm"
    build           = "pnpm build"
  }

  env = {
    STRIPE_API_KEY = secret.STRIPE_API_KEY
  }
}

Place these declarations at the top level. The config contains only the secret name; Nubes resolves its value during deployment.

Keep values out of code

Do not paste API keys into your infrastructure, example files, or agent conversations. A secret name is enough to describe the dependency.

Keep local environment files out of version control. If a credential is accidentally committed, revoke or rotate it; removing it from the latest version does not remove it from history.

Give the agent context

Tell your agent which secret names the application expects and where those names are used. It can wire the references without needing the values.