---
title: "Secrets"
description: "Set API keys and tokens on a deployed Fabric app with rayfin secret set, so they stay server-side and never reach client code."
url: https://rayfin.ai/docs/deploy/secrets
markdown_url: https://rayfin.ai/docs/deploy/secrets.md
section: deploy
product: Rayfin
sdk_version: 1.34.0
cli_version: 1.33.2
last_updated: 2026-08-23T01:28:43-07:00
source: deploy/secrets.mdx
---

# Secrets

> Set API keys and tokens on a deployed Fabric app with rayfin secret set, so they stay server-side and never reach client code.

Rayfin stores application secrets — API keys, third-party tokens, connection strings —
on the deployed app's workload, separately from the public configuration in `rayfin.yml`.
They are held server-side and never appear in client code or logs.

> [!WARNING]
> A **publishable key** (`pk-...`, the value in `rayfin/.deployments.json` and
> `RAYFIN_PUBLIC_PUBLISHABLE_KEY`) is safe to ship in client code — it identifies your
> project, not a credential. A **service secret** is not. Never put one in a
> `RAYFIN_PUBLIC_*` variable, in frontend code, or anywhere a browser can read it.

## Deploy first [#deploy-first]

Secrets attach to an existing deployment, so deploy your project before setting any:

```bash
npx rayfin up
```

## Set a secret [#set-a-secret]

```bash
npx rayfin secret set API_KEY
```

The CLI prompts for the value with masked input, so it never lands in your shell history
or in a file. The name you pass becomes the secret's name.

Repeat for each secret you need.

## List secrets [#list-secrets]

```bash
npx rayfin secret list
```

Returns names and timestamps only — values are never readable once set.

See [`rayfin secret`](/docs/reference/cli/secret) for the full command reference.

## Rotating a secret [#rotating-a-secret]

Set it again with the same name. The new value replaces the old one:

```bash
npx rayfin secret set API_KEY
```

## Current limitations [#current-limitations]

> [!IMPORTANT]
> `rayfin secret set` is **interactive only**. It reads the value from a masked prompt and
> refuses to run when `CI=true` or when stdin is not a TTY, so there is no supported way to
> set secrets from a CI pipeline or a script today.

There is also no bulk import: secrets are set one at a time, by name. Plan for a manual
step after the first deploy of a new environment.

```prompt title="Set up secrets on a deployed Rayfin app"
My Rayfin app is deployed to Microsoft Fabric. Walk me through setting its secrets.

Run `npx rayfin secret list` first to show what is already set. Then, for each secret I
name, run `npx rayfin secret set <NAME>` and let me type the value at the masked prompt —
do not ask me to paste secret values into the chat, and do not put them in any file or
command argument. Confirm afterwards with `npx rayfin secret list`.
```

## Reading a secret from your code [#reading-a-secret-from-your-code]

Secrets are exposed to server-side code — [functions](/docs/functions) — not to the
browser. Never plumb one through a `RAYFIN_PUBLIC_*` variable to reach the frontend; that
is exactly the boundary those variables mark.

## Troubleshooting [#troubleshooting]

### The command refuses to prompt [#the-command-refuses-to-prompt]

**Symptom:** `rayfin secret set` exits instead of asking for a value.

**Cause:** stdin is not a TTY, or `CI=true` is set. The command has no non-interactive mode.

**Fix:** run it from an interactive terminal.

### Authentication failed [#authentication-failed]

**Symptom:** "Failed to acquire authentication token".

**Cause:** you are not signed in, or the machine has no OS credential storage.

**Fix:** run `npx rayfin login`. On containers or restricted environments, add
`--encryption-fallback-enabled`.

### Permission denied [#permission-denied]

**Symptom:** a permission error when setting or listing secrets.

**Cause:** the signed-in account does not have access to the target Fabric workspace.

**Fix:** confirm you are signed in with an account that has workspace access. Run
`npx rayfin login` again — the account picker is always shown, so you can select a
different account or tenant.