Passwords and keys your app uses

This page helps you give your app the passwords and keys it needs, without pasting them into the chat with Claude Code. It explains what a key is, how fline's private page works, how to replace a key later, and what to do if a key ends up somewhere it shouldn't.

What a key is

A key (often called an API key) is a password your app uses to talk to another service: taking payments, sending email, or asking an AI model a question. Whoever holds the key can use that service as you, and the bill comes to you. That's why it's worth some care.

You get a key from the service that issued it, usually on a page in its own dashboard called something like "API keys", "Developers" or "Settings". Many services give you two kinds: a test key for trying things out, and a live key for real use. Your app online needs the live one.

Where your key goes: fline's private page

When your app needs a password or key, Claude Code gives you a link to a private fline page.

1. Open the link in your browser. If you're not signed in to fline there, sign in first.
2. The page lists the name of each value your app needs, like STRIPE_SECRET_KEY. Type or paste each value in its box. The eye button shows what you typed, so you can check nothing got cut off.
3. Save, then go back to Claude Code and tell it you're done.

You type it there, not in the chat. Claude Code sees that you did it, not what you typed.

• The page works once, for 10 minutes, and only while you're signed in to your own fline account.
• If the page says the link has expired or was already used, ask Claude Code for a new one. It can make another without seeing any value.
• Once you save a password or key, nothing in fline shows it again, not to Claude Code and not on your fline dashboard.
• Saved passwords never go into the build, or to the AI model fline uses to read your code.

My app needs a key for [SERVICE]. Give me fline's private page instead of asking me to paste it here.

If you already pasted a key into the chat

If you already pasted a key into the chat, Claude Code can save that key on fline itself, and it should suggest you replace it with a new key on fline's private page. fline won't show it again after that, but Claude Code has already seen it, and so has the chat.

For a key that can spend money or reach your customers' information, the careful thing is to replace it: get a new key from the service and type the new one on fline's private page. The steps are under If a key gets out.

To keep a key away from Claude Code from now on, type it only on fline's page.

Don't ask me to paste keys into the chat. When my app needs one, give me fline's private page.

Settings that aren't secret

Some of your app's settings aren't secret, like which AI model it uses or the name it shows. Claude Code can set those on fline itself, and you can see them on your fline dashboard. fline refuses to store a value as a plain setting when its name looks like a key or password, so a key doesn't end up on show by mistake.

Replace a key

You might replace a key because the service gave you a new one, or because the old one got out.

On your fline dashboard. Open your project on your fline dashboard and go to the list of your app's passwords, keys and settings (today it's called Variables). Next to the key's name, choose Replace, type the new key and save. You're typing it on fline, not in the chat.

Or ask Claude Code to give you a private page for the new key.

I have a new key for [SERVICE]. Give me fline's private page so I can replace the old one.

Then ask Claude Code to restart your app. A new key reaches your running app only when it restarts or when it's put online again.

Restart my app on fline so it uses the new key.

Putting an earlier version of your app back doesn't bring back old keys. Your current keys stay in place.

If a key gets out

If you pasted a key somewhere it shouldn't be, or you're not sure where it's been, replace it.

1. Go to the service that issued the key, like your payment or email company, and get a new key. Most services let you cancel the old one in the same place.
2. Type the new key on fline, as in Replace a key.
3. Ask Claude Code to restart your app on fline, so it starts using the new key.

Keys in your project folder

A key saved in a file in your project folder, such as a file named .env, can be read by Claude Code whenever it works in that folder, and it travels with your project when the folder is sent anywhere.

When Claude Code sends your project to fline, fline keeps files named like key files, such as .env files, and files that contain a few common kinds of key away from the AI model that reads your code. If it finds one, it tells Claude Code which file it was, and Claude Code should tell you. These files still go into your app's build, so ask Claude Code to leave them out of what it sends. fline can't catch every key, so keep live keys on fline's private page rather than in your files.

If your app prints a saved key word for word while it runs, fline blanks it out of what you and Claude Code can read. A changed or partial copy of the key gets through.

Tell me which files in my project hold keys or passwords, so I can move them to fline's private page.

Make sure no secret key ends up in the code that runs in the visitor's browser.

Next: A database of your own or Change your app after it is online