app-secrets

App Secrets

Secrets are encrypted key-value pairs stored in Fusebase and injected into the app backend at runtime as environment variables. Use them for sensitive config that must not be committed to source control (API keys, passwords, tokens, etc.).

Secrets are only available in the app server (backend/ directory). They are NOT accessible in the browser/SPA — never try to read secrets from the frontend.

Creating Secrets

Use the CLI to register secret keys (values are set on the FuseBase website):

fusebase secret create --app <appPath> --secret "KEY:description" [--secret ...]

• appPath — the app's apps[].path from fusebase.json; --feature is accepted as a deprecated alias for --app
• Each --secret is KEY or KEY:human-readable description
• Pass multiple --secret flags to create several secrets at once
• This command only edits fusebase.json (it makes no network call and prints no URL). The keys are registered on the platform — with empty values — on the next fusebase deploy / fusebase dev start, and that command prints the URL where you fill in the actual values

Examples:

# Single secret
fusebase secret create --app apps/my-app --secret "OPENAI_API_KEY:OpenAI API key"

# Multiple secrets at once
fusebase secret create --app apps/my-app \
  --secret "STRIPE_SECRET_KEY:Stripe secret key" \
  --secret "DB_PASSWORD:Database connection password" \
  --secret "WEBHOOK_SECRET:Webhook signing secret"

Then run fusebase deploy (or fusebase dev start) to register the keys on the platform. That run prints the secrets URL:

   Registered 3 new secret key(s) for apps/my-app: STRIPE_SECRET_KEY, DB_PASSWORD, WEBHOOK_SECRET
   Set their values in the FuseBase UI:
     https://{org-domain}/dashboard/{orgId}/apps/features/{appId}/secrets

Open that URL and fill in the secret values. The URL is printed only when new keys are registered — if the keys already exist on the platform, nothing is printed and you can reach the same page from the app's Secrets tab in the FuseBase UI.