Secrets
Set API keys and tokens on a deployed Fabric app with rayfin secret set, so they stay server-side and never reach client code.
Rayfin stores application secrets — API keys, third-party tokens, connection strings —
on the deployed app's workload, separately from the public configuration in rayfin.yml.
They are held server-side and never appear in client code or logs.
Warning
A publishable key (pk-..., the value in rayfin/.deployments.json and
RAYFIN_PUBLIC_PUBLISHABLE_KEY) is safe to ship in client code — it identifies your
project, not a credential. A service secret is not. Never put one in a
RAYFIN_PUBLIC_* variable, in frontend code, or anywhere a browser can read it.
Deploy first
Secrets attach to an existing deployment, so deploy your project before setting any:
npx rayfin upSet a secret
npx rayfin secret set API_KEYThe CLI prompts for the value with masked input, so it never lands in your shell history or in a file. The name you pass becomes the secret's name.
Repeat for each secret you need.
List secrets
npx rayfin secret listReturns names and timestamps only — values are never readable once set.
See rayfin secret for the full command reference.
Rotating a secret
Set it again with the same name. The new value replaces the old one:
npx rayfin secret set API_KEYCurrent limitations
Important
rayfin secret set is interactive only. It reads the value from a masked prompt and
refuses to run when CI=true or when stdin is not a TTY, so there is no supported way to
set secrets from a CI pipeline or a script today.
There is also no bulk import: secrets are set one at a time, by name. Plan for a manual step after the first deploy of a new environment.
My Rayfin app is deployed to Microsoft Fabric. Walk me through setting its secrets.
Run `npx rayfin secret list` first to show what is already set. Then, for each secret I
name, run `npx rayfin secret set <NAME>` and let me type the value at the masked prompt —
do not ask me to paste secret values into the chat, and do not put them in any file or
command argument. Confirm afterwards with `npx rayfin secret list`.Reading a secret from your code
Secrets are exposed to server-side code — functions — not to the
browser. Never plumb one through a RAYFIN_PUBLIC_* variable to reach the frontend; that
is exactly the boundary those variables mark.
Troubleshooting
The command refuses to prompt
Symptom: rayfin secret set exits instead of asking for a value.
Cause: stdin is not a TTY, or CI=true is set. The command has no non-interactive mode.
Fix: run it from an interactive terminal.
Authentication failed
Symptom: "Failed to acquire authentication token".
Cause: you are not signed in, or the machine has no OS credential storage.
Fix: run npx rayfin login. On containers or restricted environments, add
--encryption-fallback-enabled.
Permission denied
Symptom: a permission error when setting or listing secrets.
Cause: the signed-in account does not have access to the target Fabric workspace.
Fix: confirm you are signed in with an account that has workspace access. Run
npx rayfin login again — the account picker is always shown, so you can select a
different account or tenant.
Deploying with rayfin up
Deploy a Rayfin project to Microsoft Fabric with rayfin up, covering login, useful flags, deployment metadata, and redeploys.
Environments and configuration
Every environment variable file, prefix, and resolution rule Rayfin tooling reads, from frontend-visible variables to interpolation in rayfin.yml.