Secrets
Store API keys and config as client or server-scoped project secrets.
Secrets store key-value configuration for your project — API keys, webhook URLs, feature flags — with client or server scope.
Scopes
| Scope | Visible in | Use for |
|---|---|---|
| Client | App preview & builds (.env in VFS) | Public-ish keys, feature toggles |
| Server | PocketBase hooks only | Private API keys, webhook secrets |
Managing secrets
V2 Cloud → Secrets:
- Add a key name and value
- Choose client or server scope
- Save — values inject into preview on next bundle
AI usage
The AI references secrets in hook code without echoing values in chat.
Security
Warning: Client-scoped secrets ship in the app bundle. Never put truly private keys in client scope.
- Use server scope for payment providers, admin tokens, and third-party API secrets
- Rotate secrets if exposed
- OpenV2 never displays secret values after save