Secrets

Apps need keys: a payment provider secret, an email API token, a database URL. In Vision they live in Project settings → Secrets — encrypted, versioned into your environments, and never pasted into code.

Adding secrets

Three ways, use whichever fits:

• The Secrets tab — add or edit keys by hand; each key shows what it’s for.
• Paste a whole .env — drop an entire env file into the paste zone. Pasting one into chat works too: Vision spots it and offers Save to settings, so secrets never sit in your chat history.
• Ask the agent — “here’s my Stripe key: sk_…” mid-conversation works; the agent saves it as a secret, not as code.

Projects keep separate dev and prod environments (a picker appears once both exist) — your workspace uses dev values, the live app uses prod. Editing is admin-only.

The first-run checklist

When you connect an existing codebase, Vision detects the env keys the project can’t boot without and walks you through them as a checklist:

• AI guidance per key — what each key is, and where to find it, with steps
• Generate — one click for invent-your-own values (session secrets and the like)
• Managed database offer — connection-string keys can be filled instantly by provisioning the built-in database
• Skip for now — non-critical keys can be skipped (reversibly — they wait in a “Skipped for now” list)

Once nothing required is missing, the build kicks off on its own.

Secrets and the live app

Two rules keep production safe:

• Going live is blocked while required prod secrets are missing — the Publish tab tells you which ones, so a half-configured app never ships.
• The live app keeps its current values until the next publish or update — change a secret and a banner reminds you the live app is still running with older settings until you update it. (Running workspaces pick up changes right away.)

Vision also warns when a secret points at localhost — fine in dev, broken on the live app.

Where secrets are safe to use

Secrets belong on the server — in backend code, jobs, and APIs. Anything shipped to the browser is visible to anyone who opens dev tools, and the agent knows this rule and builds accordingly. If you ask for something that would expose a secret client-side, expect it to push back and route the call through the backend instead.

Integration credentials

Providers you connect through Integrations don’t need keys in the Secrets tab at all — Vision vends fresh tokens to your app at runtime, so there’s nothing to rotate by hand. And if your repo already carries its own keys for a provider, Vision detects them and defers to your setup.