# Settings and secrets

The values your app needs, kept off your computer.

Apps often need a key for an email service, a payment provider or an external API. The command finds every setting the code reads (`process.env.RESEND_API_KEY` and the like) and asks for the ones it does not already provide:

```
secrets   3 required - RESEND_API_KEY missing
          ? paste value, or press enter to skip and set later
```

## Where values live

On the platform, encrypted. Never in the code, never in `deploy.json`, never in the source we keep for you. When you [clone an app to another computer](/docs/another-computer), the secrets stay behind and the app keeps working because the platform still has them.

## Setting or changing one later

- Ask your AI: "set RESEND_API_KEY for the family app to ...".
- Or from the dashboard: the app's **Settings** tab, under *Settings your app needs*.
- Or from a terminal: `npx uarpie deploy -e RESEND_API_KEY=...`.

A change creates a new version without rebuilding the app, so it takes a few seconds and shows up in **Versions** like any other change.

## Provided for you

These are always set and never need a value from you: `PORT`, `DATABASE_URL`, `UARPIE_PROJECT_ID`, `UARPIE_PROJECT_URL`, `UARPIE_STORAGE_BUCKET`, `UARPIE_STORAGE_PREFIX`, `UARPIE_JWKS_URL`, `UARPIE_ENV`.

## Limits

All settings together must fit in 4 KB. That is plenty for keys; for anything larger (a certificate, a big JSON blob) put the file in storage and keep only its name in a setting.