Secrets guide

Environment variables checklist for AI-built apps

Env vars are where many AI-built apps fail after deployment. Local keys, preview URLs, and leaked secrets need to be cleaned before production.

What is probably broken

The app worked locally, but production fails because keys are missing, public/private vars are mixed, or callbacks still point to old URLs.

What production should look like

A clean env-var map for local, preview, and production with secrets rotated where needed.

STEP 01

Separate public and private variables

Browser-exposed variables are not secrets. Server-only variables must never be shipped to the client.

  • Mark public frontend variables separately from server secrets.
  • Keep database passwords, service role keys, webhook secrets, and private API keys server-only.
  • Do not paste production secrets into screenshots, public repos, or AI prompts.

STEP 02

Update URLs for the final domain

Every service that redirects back to your app needs the production domain.

  • Update OAuth callback URLs, Supabase auth redirects, Stripe webhook endpoints, and email link domains.
  • Remove old preview domains when they are no longer needed.
  • Test login, payment webhooks, and password reset after DNS cutover.

STEP 03

Rotate anything exposed

If a secret touched a public repo, leaked build log, browser bundle, or chat transcript, treat it as burned.

  • Rotate leaked keys before launch.
  • Delete old keys after the new deployment is verified.
  • Store final values in the deployment panel or server environment, not in source code.

Quick check

Is your app production-ready?

If you cannot tick all five, we can fix it. Send us the repo and we handle the rest.

  • ?Custom domain with HTTPS
  • ?Environment variables configured
  • ?Database wired and backed up
  • ?Auto-deploy on push
  • ?Smoke tested and live

Free checklist

Deploying this yourself?

Get the exact 5-step checklist we run before every deploy. No fluff, just the things that actually break.

No spam. Your email is only used to send the checklist.

Done-for-you deploy

RepoAssistant cleans up production env vars during deploy so launch does not fail on hidden secrets.

Fixed price per repo. 24h delivery or full refund. No hourly billing.

Deploy my app

Related guides