cubby secrets

Manage secrets (environment variables) for your app. Secrets can be set for local development or production environments.

Subcommands

Command	Description
`cubby secrets set <name>`	Set a secret
`cubby secrets list`	List secrets
`cubby secrets delete <name>`	Delete a secret
`cubby secrets apply --env prod`	Apply production secret changes without rebuilding

cubby secrets set

Set a secret for an app. The value is entered securely (hidden input).

Usage

cubby secrets set <name> [flags]

Arguments

Argument	Description
`name`	Secret name (e.g., `API_KEY`, `STRIPE_SECRET`)

Flags

Flag	Short	Description	Default
`--env`	`-e`	Environment (`local` or `prod`)	`local`

Examples

# Set local secret
cubby secrets set OPENAI_API_KEY

# Set production secret
cubby secrets set STRIPE_SECRET_KEY --env prod

Naming Convention

Secret names must be:

Uppercase letters, numbers, and underscores
Start with a letter

Examples: API_KEY, DATABASE_URL, STRIPE_SECRET_KEY

Production Secrets Workflow

Production secrets require the app to exist on the platform:

# 1. Deploy first (creates the app)
cubby deploy

# 2. Set secrets
cubby secrets set OPENAI_API_KEY --env prod

# 3. Apply without rebuilding
cubby secrets apply --env prod

Setting a production secret does not update already-running containers by itself. Run cubby secrets apply --env prod to restart the app and apply changes without rebuilding.

cubby secrets list

List all secrets for an app.

Usage

cubby secrets list [flags]

Flags

Flag	Short	Description	Default
`--reveal`	`-r`	Show secret values (hidden by default)	`false`
`--env`	`-e`	Environment (`local` or `prod`)	`local`

Examples

# List local secrets
cubby secrets list

# Show values
cubby secrets list --reveal

# List production secrets
cubby secrets list --env prod

Output

Secrets for myapp (local):

  OPENAI_API_KEY=********************
  STRIPE_SECRET_KEY=********************

  Use --reveal to show values

cubby secrets delete

Delete a secret from an app.

Usage

cubby secrets delete <name> [flags]

Arguments

Argument	Description
`name`	Secret name to delete

Flags

Flag	Short	Description	Default
`--env`	`-e`	Environment (`local` or `prod`)	`local`
`--force`	`-f`	Skip confirmation prompt	`false`

Examples

# Delete local secret
cubby secrets delete API_KEY

# Delete production secret
cubby secrets delete API_KEY --env prod

# Delete without confirmation
cubby secrets delete API_KEY --force

cubby secrets apply

Apply saved production secret changes to the running app without rebuilding the image.

Usage

cubby secrets apply --env prod

Flags

Flag	Short	Description	Default
`--env`	`-e`	Environment (`prod`)	`prod`

Examples

cubby secrets set OPENAI_API_KEY --env prod
cubby secrets apply --env prod

Reserved Names

Some environment variables are reserved and managed by Cubby:

Name	Description
`DATABASE_URL`	Automatically provisioned for apps with Prisma
`PORT`	Set by the container runtime (default: 3000)

Do not set these manually.

How Secrets Work

Local Development

Local secrets are stored on your machine and injected into the cubby dev container:

cubby secrets set API_KEY
cubby dev  # API_KEY available in container

Production

Production secrets are:

Encrypted at rest
Injected at container startup
Never logged or exposed

The workflow:

Deploy creates the app
Set secrets via cubby secrets set --env prod
Apply secrets via cubby secrets apply --env prod to restart the app without rebuilding

Accessing Secrets in Code

Secrets are available as environment variables:

// API route
export async function GET() {
  const apiKey = process.env.OPENAI_API_KEY
  // Use the secret
}

Best Practices

Never commit secrets - Use cubby secrets, not .env files in production
Use descriptive names - STRIPE_SECRET_KEY not SK
Apply after changes - Run cubby secrets apply --env prod after changing production secrets
Keep local and prod separate - Different values for each environment

cubby dev - Uses local secrets
cubby deploy - Uses production secrets

Getting Started

CLI Reference

Platform

cubby secrets

cubby secrets

Subcommands

cubby secrets set

Usage

Arguments

Flags

Examples

Naming Convention

Production Secrets Workflow

cubby secrets list

Usage

Flags

Examples

Output

cubby secrets delete

Usage

Arguments

Flags

Examples

cubby secrets apply

Usage

Flags

Examples

Reserved Names

How Secrets Work

Local Development

Production

Accessing Secrets in Code

Best Practices

​cubby secrets

​Subcommands

​cubby secrets set

​Usage

​Arguments

​Flags

​Examples

​Naming Convention

​Production Secrets Workflow

​cubby secrets list

​Usage

​Flags

​Examples

​Output

​cubby secrets delete

​Usage

​Arguments

​Flags

​Examples

​cubby secrets apply

​Usage

​Flags

​Examples

​Reserved Names

​How Secrets Work

​Local Development

​Production

​Accessing Secrets in Code

​Best Practices

​Related Commands

cubby secrets

Subcommands

cubby secrets set

Usage

Arguments

Flags

Examples

Naming Convention

Production Secrets Workflow

cubby secrets list

Usage

Flags

Examples

Output

cubby secrets delete

Usage

Arguments

Flags

Examples

cubby secrets apply

Usage

Flags

Examples

Reserved Names

How Secrets Work

Local Development

Production

Accessing Secrets in Code

Best Practices

Related Commands