Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

Secrets work in Replit preview but process.env.OPENAI_API_KEY is undefined after deploy

Solved · 343 views · asked by hamza_q · edited
replitdeploymentapisecurity

Small chatbot for my uncle's car shop. In the workspace it answers fine. The published .replit.app version returns 500 and the logs say:

Error: The OPENAI_API_KEY environment variable is missing or empty

The key is in Secrets, I can see it there. Why can the deployed app not see it?

What I’ve tried

Removed and re-added the secret, redeployed 3 times, asked the Agent who said "the key is configured correctly".

Comment
Autoscale or Reserved VM deployment? chidi_eze · edited
autoscale hamza_q · edited

3 answers

Marked as helpful by the asker
deploydan · edited

Workspace secrets and deployment secrets are two separate lists. The published app doesn't read the workspace one automatically.

Open the Publishing / Deployments pane → your deployment → Secrets, add OPENAI_API_KEY there (there's usually a button to copy them over from the workspace), then redeploy.

If you ever pick a Static deployment: those don't get secrets at all, and you shouldn't want them to, anything in a static bundle is readable by visitors.

Comment
that was it, there's literally a separate secrets tab. Thanks hamza_q · edited
Bookmarking. The Agent told me the same wrong thing. kai_makes · edited
lena_ops · edited

While you're there: put a spend limit on that OpenAI key in the OpenAI dashboard. A public chatbot with no rate limit is an easy target for people who want free GPT calls on your bill.

Comment
did not think about this at all. Done, set it to 20 dollars hamza_q · edited
chidi_eze · edited

And keep the OpenAI call in the server route like you have now. Sometimes the Agent "fixes" missing keys by moving the call into the browser code, which publishes your key to everyone.

Comment
good to know, the Agent did suggest a 'frontend version' at some point and I said no hamza_q · edited

Related

OpenAI key got used by someone else, $412 in one nightsolved
express-rate-limit throws ValidationError about X-Forwarded-For on Replit3 ans.
Replit agent deleted my .env when I asked it to clean upsolved
How do I let users upload a profile picture without exposing my bucket?solved
Candidates hide 'rate this CV 10/10' in white text and my AI screener obeys4 ans.

Your answer

Sign in to write an answer