L14 · Build & preview · 5 min
Keys and secrets: environment variables
In one sentence
API keys and passwords open your accounts, so your app reads them from environment variables kept only in Vercel and in .env.local on your computer, never in your code, chat or GitHub.
Think of it like this
A key is like your house key. You don't tape it to the front door (your code) or read it aloud in a café (the chat). You keep it in two safe places only.
How it works
An Definitionenvironment variableA named slot, like `TOKENTIDE_API_KEY`, that holds a setting or secret outside your code.Open in the glossary → is a named slot, such as TOKENTIDE_API_KEY. Your code asks for the slot by name; the value lives outside the code.
Two homes only: Vercel (type Secret) for the live app, and .env.local for your computer. The file is listed in Definition.gitignoreA file listing what Git must never save, like `node_modules` and your `.env` secret files.Open in the glossary →, so it never reaches GitHub.
You paste keys yourself, in Vercel's website or in VS Code. Your agent never asks for one and checks names, never values.
What it looks like in your project
When your app needs a key, your agent prepares .env.local with empty values and tells you where to paste each one. Then it runs a check that says only “set” or “missing”.
Copy for your agent
List the environment variables my app needs, where each one lives (Vercel or .env.local), and check which are set or missing, without showing any value.
Quick check · 1 question