# Secrets Management

Secrets allow you to store sensitive information securely within your Genie environment. This includes API keys, database credentials, tokens, and any other data that should not be exposed in plain text.

***

## Why Use Secrets

Hardcoding sensitive data in your code or configuration files creates security risks. If your code is shared, committed to version control, or exposed, those credentials become compromised.

Genie Secrets solves this by:

* Encrypting all stored values at rest
* Injecting secrets as environment variables at runtime
* Keeping sensitive data out of your codebase
* Providing a centralized place to manage credentials

***

## How Secrets Work

When you add a secret in Genie, it is stored encrypted and automatically made available as an environment variable in your terminal and applications.

For example, if you store a secret named `OPENAI_API_KEY`, you can access it in your code using standard environment variable methods:

```bash
echo $OPENAI_API_KEY
```

```python
import os
api_key = os.getenv("OPENAI_API_KEY")
```

```javascript
const apiKey = process.env.OPENAI_API_KEY;
```

This keeps your credentials secure while making them easy to use.

***

## Managing Secrets

From the Secrets panel in your settings, you can:

* Add new secrets with a name, value, and optional description
* Update existing secrets when credentials change
* Delete secrets that are no longer needed
* View when each secret was created and last accessed

Secret values are never displayed in plain text by default. You must explicitly reveal them and confirm your identity before viewing.

***

## Common Secrets to Store

* API keys for services like OpenAI, Stripe, AWS, and GitHub
* Database connection strings
* OAuth tokens for third-party integrations
* SMTP credentials for email services
* Bot tokens for Telegram and Discord

***

## Best Practices

* Never commit secrets to version control
* Use descriptive, uppercase names with underscores
* Rotate credentials regularly for high-security environments
* Use separate secrets for development and production
* Keep your secrets list focused — only store what you actively use