Secrets

App secrets are environment variables whose values are encrypted at rest and injected into your app at deploy time.

How secrets workCopy Anchor Link

1. You set a secret value via the UI or API
2. canette encrypts it with AES-256-GCM using a master key stored in a Kubernetes Secret
3. At deploy time, the API decrypts the value and creates a Kubernetes Secret in the app's namespace
4. The secret is mounted as an environment variable in the app's Deployment

Security propertiesCopy Anchor Link

• Secret values are never returned by the API after being stored
• Secret values are never logged at any log level
• Secret values are never stored in plaintext
• Deleting an app deletes all its secrets (cascade)

Setting secretsCopy Anchor Link

In the app page, open the Secrets tab and click Add secret. Enter the name and value — the value is encrypted before leaving your browser session.

To reference a secret in your app, list its name in canette.yaml:

secrets:
  - DATABASE_URL
  - STRIPE_SECRET_KEY