> ## Documentation Index
> Fetch the complete documentation index at: https://antideploy.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets and Credentials

> How Antideploy stores credentials: one encrypted, write-only store shared with environment variables, and what that means for rotation.

Antideploy has no separate secrets feature, because it does not need one:
**every environment variable is already stored as a secret.**

## One store

There is no second, weaker place to put a value. Everything you set goes to the
same place and gets the same treatment.

|               |                                                                 |
| ------------- | --------------------------------------------------------------- |
| At rest       | Encrypted with AES-256-GCM                                      |
| Readable back | No, not in the dashboard, not with a valid API key              |
| In the build  | Never. Values are injected at release, not baked into the image |
| Listing       | Returns key names and when they were last set, never values     |

This is why the dashboard shows one panel called **Environment variables** and
the API endpoint is called `/api/v1/secrets`. Same store, two names.

<Warning>
  Because values cannot be read back, keep your own copy of anything you cannot
  regenerate. If you lose a value you did not save elsewhere, the only way
  forward is to issue a new credential and set it again.
</Warning>

## Reading them in your app

Secrets arrive as ordinary environment variables. There is nothing to mount,
unseal, or call.

```javascript theme={null}
// Node.js
const stripeKey = process.env.STRIPE_SECRET_KEY;
```

```python theme={null}
# Python
import os
stripe_key = os.environ["STRIPE_SECRET_KEY"]
```

```go theme={null}
// Go
stripeKey := os.Getenv("STRIPE_SECRET_KEY")
```

## Rotating a credential

<Steps>
  <Step title="Issue the new credential">
    Create it in the provider: Stripe, your OAuth app, wherever it comes from.
    Leave the old one active for now.
  </Step>

  <Step title="Set the new value">
    Update it in the dashboard, or `PUT` it over the API. Storing it does not
    change what the running app is using.
  </Step>

  <Step title="Redeploy">
    The new value reaches your app when it next starts. Until then the running
    container still holds the old one.
  </Step>

  <Step title="Revoke the old credential">
    Once the new deployment is live and healthy, revoke the old one at the
    provider.
  </Step>
</Steps>

<Note>
  The redeploy in step three is not optional. A container's environment is fixed
  for the life of that revision; there is no mechanism that swaps a value under
  a running app.
</Note>

## What is not tracked

<Warning>
  Antideploy does not keep an audit log. There is no record of who read, set, or
  deleted a value, and no access history to review after an incident.

  If you need that, treat the credential's own provider as the source of truth:
  most will show you when a key was last used.
</Warning>

Deleting an application deletes its stored values along with everything else it
owned.

<Card title="Environment variables" icon="key" href="/docs/configuration/environment-variables">
  Setting values, and the ones Antideploy injects for you.
</Card>