---
title: Secrets
description: "Values set with the CLI, never in sproutboat.jsonc, read as a plain string."
---

## Configuration

```jsonc
"secrets": ["STRIPE_KEY"]
```

Only the binding name goes in the config. Set the value with the CLI after the project's first deploy:

```sh npm
echo -n "$VALUE" | npx sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
npx sproutboat secrets put STRIPE_KEY --value sk_test_example
```

```sh pnpm
echo -n "$VALUE" | pnpm sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
pnpm sproutboat secrets put STRIPE_KEY --value sk_test_example
```

```sh bun
echo -n "$VALUE" | bunx sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
bunx sproutboat secrets put STRIPE_KEY --value sk_test_example
```

```sh yarn
echo -n "$VALUE" | yarn sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
yarn sproutboat secrets put STRIPE_KEY --value sk_test_example
```

Values are stored encrypted, up to 8 KiB each. A new value applies from the next deploy.

## Usage

```js
env.STRIPE_KEY // -> plain string
```

## Local and standalone values

- **`sproutboat dev`** reads secrets from a `.dev.vars` file next to `sproutboat.jsonc` or from the `.env` files, never both, as `wrangler dev` does. `sproutboat init` adds `.dev.vars` to `.gitignore`. The process environment is not passed to the app. A declared secret with no value is a warning, and `dev` still starts. See [how `dev` finds its files](/docs/get-started/standalone#sproutboat-dev-follows-wrangler).
- **A [standalone binary](/docs/get-started/standalone)** reads each secret from the environment variable of the same name. [`sproutboat run`](/docs/get-started/standalone#launching-with-sproutboat-run) supplies them from env files at launch, and fails to start if a declared secret is missing, like `wrangler deploy`.

## Related

- [CLI reference: secrets](/docs/reference/cli#configure)