encore-secret

Encore Secrets

Instructions

Secrets are encrypted, environment-scoped values managed by Encore. Declare them at package level by calling secret(name) and read them by calling the returned function.

import { secret } from "encore.dev/config";
 
// Package-level declaration
const stripeKey = secret("StripeSecretKey");
 
// Read inside a handler
async function chargeCustomer() {
  const key

Secret names are globally unique across the application (the same name resolves to the same value everywhere).

Setting values

Environment types: production (alias prod), development (alias dev), preview (alias pr), local.

Local overrides

For local development without going through encore secret set, create a .secrets.local.cue file at the repo root (gitignore it):

Common usage patterns

Guidelines

• Always declare secret(...) at package level, never inside functions.
• Read with a function call: stripeKey() not stripeKey.
• Set distinct values per environment via encore secret set --type <env>.
• Never commit secret values; use .secrets.local.cue for local overrides and gitignore it.
• For webhook signature secrets specifically, see also the encore-webhook skill.