Secrets

set_secret(app: "hn-digest", key: "OPENAI_API_KEY", value: "sk-…")

Encrypted at rest and injected as an environment variable on the next deploy. Setting one does not restart a running app, so deploy again or the app will not see it.

Nothing reads a value back out. The API lists names only; encryption at rest would be theatre if any key holder could ask for the plaintext. A lost secret is re-set, not recovered.

A static site has no process, so it never sees them. Setting a secret on a deployed dist/ succeeds and changes nothing: a front end's configuration was baked in by its bundler on the machine that built it. Secrets are for apps with a server. And whatever a browser can read is public regardless of where it came from, so an API key belongs in a server that calls out, never in the page.