Guides / Replit secrets

Replit apps: keep API keys in Secrets, not in your code

How to make sure your Replit app keeps API keys in Replit Secrets on the server, and does not leak them to the browser.

What it is

Replit has a Secrets tool that stores keys as environment variables for your app’s server code. That protects keys only if they stay on the server. If a key is pasted into a file, or your frontend code reads it and sends it to the browser, it is public again. Anything that runs in the visitor’s browser can be read by the visitor.

How to check

1. Search your project for key patterns (sk-, sk_live_, AKIA) outside of Secrets.
2. Make sure frontend code never receives a secret value. Only your server should call paid APIs.
3. After publishing, check that your published app also has the secrets it needs, rather than a hard-coded fallback.
4. Run a free Cobalt Owl scan to search the live JavaScript for exposed keys.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

Audit my Replit project for API keys. Move every secret into Replit Secrets and read it only in server-side code via environment variables. Make sure no secret is ever sent to the browser or bundled into frontend code: frontend code should call my own server endpoint instead. List each key you moved so I can rotate any that were exposed.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• Replit: Secrets

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.