> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyzecloud.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage secrets

> Store API keys, database URLs, and runtime configuration safely.

Use app environment variables for values that change between environments or should not be committed to code.

## Goal

Store production configuration safely outside your source code.

## When to use

Use this for database URLs, API keys, session secrets, and third-party credentials.

## Common secrets

| Secret         | Example variable | Where it comes from        |
| -------------- | ---------------- | -------------------------- |
| Database URL   | `DATABASE_URL`   | Database creation response |
| API key        | `HYZE_API_KEY`   | Dashboard or API Keys API  |
| Session secret | `SESSION_SECRET` | Your app or auth provider  |
| Webhook secret | `WEBHOOK_SECRET` | Third-party integration    |

## Update app environment variables

```bash theme={"system"}
curl -X PUT https://api.hyzecloud.com/api/apps/app_001/env \
  -H "Authorization: Bearer hyze_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "envVars": {
      "NODE_ENV": "production",
      "DATABASE_URL": "postgresql://user:pass@host:5432/db"
    }
  }'
```

<Tip>
  `PUT /api/apps/:appId/env` merges the submitted variables into the existing environment.
</Tip>

## How it works

Hyze Cloud stores the variables with the app and injects them when the app starts.

Restart the app after changing values used during startup.

## Rotate an API key

<Steps>
  <Step title="Create a replacement key">
    ```bash theme={"system"}
    curl -X POST https://api.hyzecloud.com/api/api-keys/ \
      -H "Authorization: Bearer hyze_your_key" \
      -H "Content-Type: application/json" \
      -d '{ "name": "CI/CD replacement" }'
    ```
  </Step>

  <Step title="Update your systems">
    Replace the old key in CI/CD, internal services, or any integration that calls Hyze Cloud.
  </Step>

  <Step title="Revoke the old key">
    ```bash theme={"system"}
    curl -X DELETE https://api.hyzecloud.com/api/api-keys/key_abc123 \
      -H "Authorization: Bearer hyze_your_key"
    ```
  </Step>
</Steps>

<Callout type="warning">
  A new API key value is shown only once. Store it immediately in your secret manager.
</Callout>

## Related endpoints

<CardGroup cols={2}>
  <Card title="API keys" icon="key" href="/api-reference/api-keys">
    Create, update, disable, and revoke API keys.
  </Card>

  <Card title="Apps" icon="cube" href="/api-reference/apps">
    Read and update app environment variables.
  </Card>
</CardGroup>