--- title: "Secrets" description: "Add API keys, passwords and connection strings that your app's Rayfin functions read on the server, without putting their values in your code." url: https://spatney.github.io/rayfin-fabricator/docs/build/secrets markdown_url: https://spatney.github.io/rayfin-fabricator/docs/build/secrets.md app_version: "1.20.1" section: build product: Fabricator last_updated: 2026-10-04T23:05:47-07:00 source: build/secrets.mdx --- # Secrets > Add API keys, passwords and connection strings that your app's Rayfin functions read on the server, without putting their values in your code. Secrets are values such as API keys, passwords and connection strings that your app needs on the server but must never send to the browser. In the **Secrets** tab, Fabricator stores them with your deployed app through the Rayfin CLI, and your app's Rayfin functions read them by name. > [!IMPORTANT] > Only Rayfin functions can read secrets. Functions are available from Rayfin 1.36, but not in every Fabric region or tenant. See [Functions](https://rayfin.ai/docs/functions) in Rayfin's docs. ![The Secrets view listing OPENAI_API_KEY, SLACK_WEBHOOK_URL with No value, and STRIPE_SECRET_KEY, with the details of OPENAI_API_KEY, including the ctx.Secrets.OPENAI_API_KEY line a function uses to read it.](https://spatney.github.io/rayfin-fabricator/screenshots/secrets.webp) ## Before you start - Deploy your app. Secrets live on the deployed app, so until it's deployed, the tab shows **Deploy your app first**. - Use Rayfin 1.36 or newer. With an older version, the tab shows **Update Rayfin to use secrets**: select Rayfin in the status bar and choose **Update with Copilot**. - To add or change secrets, use an app outside a team workspace. For a team app, the tab lists secrets but can't change them. See [Secrets in a team app](https://spatney.github.io/rayfin-fabricator/docs/build/secrets#secrets-in-a-team-app). ## Open the Secrets tab 1. Open a project. 2. In the app bar, select **Code**. 3. In the code view's segmented control, select **Secrets**. The tab lists each secret's name and description, whether the deployed app has a value for it, and when that value last changed. It never shows values: nobody can read a value back, not even you. ## Add a secret 1. Select **New secret**. 2. Type a **Name**. Fabricator writes names in capital letters with underscores, such as `OPENAI_API_KEY`. A name starts with a letter. 3. Paste the **Value**. To check what you pasted, select **Show value** (the eye button). 4. Optionally, fill in **What it’s for**. Never put the value here. 5. Select **Add secret**. Fabricator runs `rayfin secret set` and hands it the value directly, so the value is stored with your deployed app and isn't saved in your project or in Fabricator. The Rayfin CLI adds the name and description to `rayfin/rayfin.yml` and updates the types that functions use, and Fabricator saves that change to git history as "Add secret: NAME". ## Use a secret in a function A function reads a secret by its name: ```ts const apiKey = ctx.Secrets.OPENAI_API_KEY ``` Select a secret to see this line with a copy button. To have Copilot use the secret, select **Ask Copilot to use it**: Fabricator switches to **Build** and places a request about the secret in the chat composer, so you can add what the function should do before you send it. Copilot sees the secret's name, never its value. ```prompt title="Summarize expense notes with AI" Add a Rayfin function that summarizes an expense's notes with the OpenAI API, using the OPENAI_API_KEY secret. Show the summary on the expense details page, with a loading state while it runs. ``` Read secrets only inside functions. Code that runs in the browser can't see secrets, and anything you put there is public. For how functions read secrets, see [Secrets in functions](https://rayfin.ai/docs/functions/secrets) in Rayfin's docs. ## Replace a value 1. Select the secret. 2. Select **Replace value**. 3. Paste the new value, then select **Replace value**. Functions get the new value from their next run. Because nobody can read a value back, keep the original in a safe place, such as your password manager or the service that issued it. ## Delete a secret 1. Select the secret. 2. Select **Delete**, then confirm **Delete**. Fabricator removes the secret from your deployed app and from `rayfin/rayfin.yml`. Functions that read it stop working until you add it again. ## Fix a secret that shows No value A secret shows **No value** when `rayfin/rayfin.yml` lists it but the deployed app has no value for it, for example after you deploy the app to another Fabric workspace. Functions that read it fail. 1. Select the secret. 2. Select **Set value**. 3. Paste its value, then select **Set value**. A secret shows **Not in rayfin.yml** when the deployed app has a value for it but `rayfin/rayfin.yml` doesn't list it, so functions can't read it by name. To add it, set its value again. ## Secrets in a team app The pipeline of a [team workspace](https://spatney.github.io/rayfin-fabricator/docs/team) deploys each app twice: the published app that everyone uses, and your preview. Each one keeps its own secrets, so your preview's functions read your preview's secrets, and the published app's functions read the published app's secrets. For a team app, the **Secrets** tab lists the secrets of both under **Published app** and **Your preview**, but it can't add, replace or delete them yet. Until your preview deploys, **Your preview** shows "Not deployed yet. Your preview’s secrets show here once the pipeline deploys it." If a deploy fails, the tab still lists the secrets of the version that's live. To add or change a team app's secret: 1. In the **Secrets** tab, select **Open in Fabric** next to **Published app** or **Your preview**. The app opens in the Fabric portal. 2. Add or change the secret there. 3. In Fabricator, select **Refresh** at the top of the tab. **Ask Copilot to use it** works the same as for other apps. When the secret shows **Not in rayfin.yml**, the request also asks Copilot to add it to `rayfin/rayfin.yml`, so functions can read it by name. ## If the tab can't read your secrets If the tab shows "Couldn’t read this app’s secrets", the message under it says why. When your Fabric sign-in has expired, open the account menu, select **Refresh Fabric authentication**, then select **Try again**. If it still fails, see [Report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).