← PLATFORM / Secrets & Environment Variables

Keep the config. Protect the credentials.

AI tools often paste API keys straight into code. With Adios, adios.yaml holds secret:// references and the real values live in team secret storage. Your agent can wire up the config without needing the values in your repo.

Add secrets to an app ↗Read the secrets docs

Free to start, no card. Always-on hosting from $10/month.

IN PRACTICE

Configure a payment webhook without exposing its keys.

Commit secret:// references for a payment provider's API key and signing secret. Set the real values with the CLI. Neither value goes into Git or a copied manifest.

adios.yaml excerpt

env:
  PUBLIC_APP_URL: https://dashboard.example.com
  FEATURE_SEARCH: "true"
  DATABASE_URL: secret://DATABASE_URL
  STRIPE_SECRET_KEY: secret://STRIPE_SECRET_KEY

HOW IT WORKS

Keep the reference with the app and the value outside it.

Read the guide ↗

01
Add the secret with the dashboard or adios secrets set NAME --stdin.
02
Reference it in adios.yaml as secret://NAME.
03
Deploy. The value is resolved for the runtime, not stored in your repo.

WHY IT BELONGS HERE

Your deploy file should show what an app needs, not the passwords.

Raw values in .env files, manifests, screenshots, or copied commands are easy to leak and hard to rotate.

Keep the deploy file reviewable

Teammates can see that the app needs DATABASE_URL without seeing its value.

Change credentials without changing code

Update a team secret, then deploy or restart the app to pick up the new value.

Keep public and private config apart

Plain settings and secret:// references both go in env. Keep private keys on the server, since public-prefixed variables can end up in browser bundles.

What’s included

✓ secret:// references in the env block of adios.yaml
✓ Team secrets from the dashboard or CLI
✓ Build-only SSH keys for private dependencies
✓ Generated values with secret://generate:64

PLANS AND LIMITS

Secrets are included on every plan.

Secrets belong to your team and are stored in its home region unless you choose another region.
Teammates with access can reveal a value, so share team access with care.
Public-prefixed variables can be baked into browser bundles.

Compare plans →

DOCSRead the secrets docs

CONNECTED CAPABILITIES