Use production credentials without putting them in your repo.

Commit secret:// references so required credential names remain visible while their values are stored separately, then resolved for the runtime or workflow that needs them.

Add secrets to an app Read the manifest guide

adios.yaml excerpt

env:
  PUBLIC_APP_URL: https://dashboard.example.com
  FEATURE_SEARCH: "true"

secrets:
  DATABASE_URL: secret://DATABASE_URL
  STRIPE_SECRET_KEY: secret://STRIPE_SECRET_KEY

Example outcome

Configure a payment webhook without exposing its keys.

Commit references for the provider API key and signing secret, resolve stored values for the workload, and keep both credentials out of Git and copied manifests.

Keep the deploy contract reviewable

Teammates can see that the app needs DATABASE_URL without seeing its value.

Change credentials without rewriting source

Manage and rotate team-scoped secrets independently from application commits.

Give values only to the path that needs them

Keep public config separate from private runtime and workflow credentials.

Why this matters

A reviewable deploy contract should not expose the credentials it references.

Raw values in .env files, manifests, screenshots, or copied commands are easy to leak and hard to rotate without touching application source.

What changes with Adios

Reference secrets by name and resolve them where they are used

Keep public configuration readable while private credentials stay in the Adios secret store and out of source, screenshots, and copied manifests.

How it works

Keep the reference with the app and the value outside it.

Step 01
Create or update the secret in Adios.
Step 02
Reference it in adios.yaml with secret://NAME.
Step 03
Deploy without putting raw values in your repository.

A real use case

Configure a payment webhook without exposing its keys.

Commit references for the provider API key and signing secret, resolve stored values for the workload, and keep both credentials out of Git and copied manifests.

secret:// references in runtime env config

CLI and workspace secret management

Runtime and workflow secret references

Works with app and workflow manifests

Terminal

adios secrets set DATABASE_URL
adios secrets list
adios up

Start here

Keep the deploy contract visible and its credentials private.

Reference the values your app needs, manage them separately, and deploy without copying secrets into source.

Add secrets to an app

Keep building

The next pieces usually connected to this one.

View all features

Runtime Security

Adios places managed gateways in front of public apps, keeps credentials outside source, supports runtime controls where available, and lets internal services remain non-routable.

Explore →

Managed Databases

Create Postgres, pgvector, Redis, MongoDB, MySQL, or RabbitMQ, declare the dependency in requires, and let Adios inject its connection details into the workload.

Explore →

Workflows & Automation

Define webhook, event, schedule, or manual triggers and ordered steps in YAML. Each run keeps its status, logs, inputs, outputs, and errors after the original request ends.

Explore →