npx skills add ...
npx skills add encoredev/skills --skill encore-go-secret
npx skills add encoredev/skills --skill encore-go-secret
Manage API keys, credentials, and other secrets in Encore Go using a package-level `secrets` struct.
Secrets are encrypted, environment-scoped values managed by Encore. Declare them as a package-level secrets struct — Encore reads the field names and resolves each to the right value at runtime.
Secret keys are globally unique across the application — SendGridAPIKey resolves to the same value regardless of which package declares it.
Environment types: production (alias prod), development (alias dev), preview (alias pr), local.
For local development without going through encore secret set, create a .secrets.local.cue file at the repo root (gitignore it):
secrets struct, not as individual secret(...) calls.encore secret set.encore secret set --type <env>..secrets.local.cue for local overrides and gitignore it.encore-go-webhook skill.# Set per environment type
encore secret set --type prod SendGridAPIKey
encore secret set --type dev SendGridAPIKey
encore secret set --type local SendGridAPIKeySendGridAPIKey: "SG.local-test-key"
GitHubAPIToken: "ghp_local_..."package github
import (
"context"
"net/http"
)
var secrets struct {
GitHubAPIToken string
}
func callGitHub(ctx context.Context) error {
req, _ := http.NewRequestWithContext(ctx, "GET", "https://api.github.com/user", nil)
req.Header.Set("Authorization", "token "+secrets.GitHubAPIToken)
resp, err := http.DefaultClient.Do(req)
if err != nil {
return err
}
defer resp.Body.Close()
return nil
}package webhooks
var secrets struct {
StripeWebhookSecret string
}
// Verify Stripe signature using secrets.StripeWebhookSecret in a raw endpoint.