Environment Variables
External services identify your app with keys, tokens, URLs, and IDs. The safe location depends on whether the provider designed a value to be public.
Two separate secret stores
Appsanic connector storage and your published backend's environment are not the same thing.
- A project connector stores credentials Appsanic needs to validate a
connection and perform eligible build-time work. Open the project build, select Connectors, and choose the provider. Secret fields are encrypted with AES-256-GCM and display as dots after save.
- A runtime secret manager belongs to the backend or function your users'
app calls after publication. Configure those secrets directly with that host, such as Supabase Edge Function Secrets, Cloudflare Workers secrets, or your server platform's encrypted environment settings.
Connecting OpenAI, Stripe, Twilio, Resend, or another secret-key service does not copy the saved connector credential into a deployed backend. The agent can generate a narrow proxy and tell you which variable names it expects, but you must deploy the proxy and provision a dedicated runtime credential yourself.
Never paste a secret into chat. The agent should direct you to the project connector form or the deployed backend's secret manager. Revoke and replace any secret that enters chat, source control, logs, screenshots, or a client bundle.
Publishable values
Some values are designed to appear in browser or mobile code:
- Supabase project URL and anon/publishable key, protected by Row Level
Security;
- Stripe publishable key, which cannot create charges by itself;
- Mapbox public tokens with only the client scopes the app needs;
- PostHog project key;
- Sentry DSN;
- RevenueCat platform SDK keys; and
- AdMob app and ad-unit IDs.
Appsanic's preview does not run the usual Expo environment-variable inlining step, so the build agent writes approved public connector values as string literals in one shared client configuration module. That is safe only for provider-defined publishable values. Use only restriction types the provider supports for that client: for example, Mapbox URL restrictions are web-only and do not accept native bundle IDs or package names.
Do not assume a value is public because its name contains key. Check the provider's documentation and the connector's setup guide.
Server-only values
These must never appear in generated client source:
- Supabase service-role key and management token;
- Stripe secret key and webhook signing secret;
- Google Maps REST API keys;
- OpenAI, Anthropic, and Replicate API keys;
- Resend API key;
- Twilio Auth Token or API-key secret;
- Expo Push token and OneSignal REST API key;
- Algolia admin/indexing key;
- RevenueCat secret REST key; and
- OAuth client secrets, private keys, passwords, and service-account JSON.
The model prompt does not receive these saved connector values. Trusted server-side connector code can decrypt a value only within the authorised project/job boundary for validation or an eligible build-time action.
If your published app needs one, put a dedicated least-privilege credential in a narrow backend's secret manager. The client should receive only the backend URL and the minimum response data it needs. Protect the backend with app-user authentication, authorization, validation, quotas, and provider-specific allowlists; do not expose a generic authenticated proxy.
Rotating a value
- Revoke or rotate it in the provider dashboard.
- Update the affected Appsanic project's connector if build-time validation or
actions use that credential.
- Separately update every deployed backend environment that uses its own
runtime credential.
- Select Test now in the connector surface.
- Rebuild the app if a changed publishable value was embedded in client code.
- Review provider usage and connector AI activity for anything unexpected.
Updating a connector does not update a backend secret, and updating a backend secret does not update the connector.
Development, staging, and production
Use different provider projects/accounts and credentials for each environment. Because Appsanic connectors are project-scoped, separate Appsanic projects can hold separate development, staging, and production connections.
Use test-mode Stripe keys and sandbox services during development. Give each credential only the permissions the environment needs, and never reuse a live master credential merely because it is convenient.
Exported code
An Appsanic-generated project does not rely on a client-side .env file for its connected public values, and it never includes connector secrets. After export, your engineering team may choose to refactor public configuration into Expo's EXPO_PUBLIC_* build variables. Those variables are still bundled and visible to every user, so they remain suitable only for publishable values.
Unprefixed process.env access is appropriate only in a real server runtime. It does not make a value secret if the module is imported by client code.
For the full build-time/runtime distinction, read Connectors Overview.