Store an API key

Secrets are stored on the server, outside your Site's files. Once set, a value can't be read back.

Set a secret

Preview and Live have separate values. Set both:

hm secrets set STRIPE_KEY --scope preview
hm secrets set STRIPE_KEY --scope live

hm asks for the value without showing it. Use a test key on Preview and the real key on Live.

See what's set

hm secrets list

This shows names only, never values.

Use it in PHP

require_once __DIR__ . '/../includes/secrets.php';
$key = haume_site_secret('STRIPE_KEY');

Secrets are not environment variables. Use the helper.

Remove a secret

hm secrets unset STRIPE_KEY --scope live

Good to know

• Preview never falls back to the Live value. If it's missing on Preview, it's missing.
• Calling outside services (like Stripe) needs a paid Plan. See Network access.