---
title: Save API keys as secrets
description: Keep API keys outside your code and read them as env vars.
---

Your app reads API keys as Worker env vars (like `env.MY_KEY`). Set them outside the code so they never ship in a file. The next pages cover who can see your app, the content rules, and your data.

1. Open your app in the [Console](/get-started/console-tour) → Secrets.
2. Add the secret with its name and value.
3. Ask your agent to deploy so the running app picks it up.

| Rule | Value |
| --- | --- |
| Name shape | `^[A-Z_][A-Z0-9_]{0,63}$` |
| Value size | At most 4 KiB |
| Count | At most 50 per app |
| Timing | Applies on the next deploy; setting one never touches the running fleet |

Your agent can also set them with `set_secret` and remove them with `unset_secret`. Values are never shown again after saving, not even to you. How agents use them: [Store API keys as secrets](/agents/security/secrets).

:::note
Builds never see secrets, so build scripts must not require them. For sending mail, use an HTTP email API with your own key: [Sending email](/backend/sending-email).
:::