---
title: Secrets
description: "Values set out of band with the CLI, never in sproutboat.jsonc, read as a plain string."
---

## Configuration

```jsonc
"secrets": ["STRIPE_KEY"]
```

Only the binding name goes in the config. The value is set separately with the CLI, never committed:

<CodeGroup>

```sh Bun
echo -n "$VALUE" | bunx sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
bunx sproutboat secrets put STRIPE_KEY --value sk_test_example
```

```sh npm
echo -n "$VALUE" | npx sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
npx sproutboat secrets put STRIPE_KEY --value sk_test_example
```

</CodeGroup>

## Usage

```js
env.STRIPE_KEY // -> plain string
```

:::note
The runtime fetches a secret once and caches it for the process lifetime. A new value means a redeploy.
:::

## Related

- [CLI reference — secrets](/reference/cli#secrets)