# Secrets

URL: https://docs.nolay.ru/en/guides/secrets/
Updated: 2026-09-23

> Give a project passwords and keys so that their values are not stored in the panel and never reach the repository.

A secret is an environment variable whose value must not go into the repository: a database password, an API key, a token. After this page the project has its secrets, and their values exist only on your server.

## How to set them

1. Open the project in the panel, the Secrets tab.
2. In the Add or replace block enter a key and a value; Add row gives the next one. You can paste a whole `.env` file into the key field or switch to the .env mode.
3. Click Save secrets. Above the button you see how many keys will be added, changed and removed. The panel sends the set to the agent and the project restarts with the new variables. The image is not rebuilt.

![Saved keys show only their names; a value can only be replaced with a new one.](https://docs.nolay.ru/shots/en/project-secrets-light.png)

> **Values are not shown**
>
> The panel does not know previous values: a saved key can be replaced with a new value or removed, but not viewed. If the page notes an old agent version, a key can be removed only together with new values for the other keys.

## Where values are stored

| Where | What is there |
|---|---|
| Panel | Only key names and a fingerprint of the set. No values in the database or the action log |
| Hub | The value passes through: it sits encrypted in the command queue until it is delivered to the agent |
| Your server | Values are encrypted with AES-256-GCM using `/etc/nolay/agent.key` in the agent database |

A value cannot be viewed again after saving anywhere, not even with `nolay-agent status`: it prints only names.

## Secrets and `[env]`

Non-secret variables can live in `nolay.toml`:

```toml
[env]
NODE_ENV = "production"
LOG_LEVEL = "info"
```

Secrets and `[env]` reach the container together. If a key is in both, the secret wins. Keys use capital Latin letters, digits and `_`.

## Service keys `NOLAY_*`

Keys with the `NOLAY_` prefix are for the agent itself and never reach the application container:

| Key | Purpose |
|---|---|
| `NOLAY_GIT_TOKEN` | access to a private repository over HTTPS |
| `NOLAY_GIT_SSH_KEY` | access to a private repository over SSH, as a multiline value |
| `NOLAY_GIT_SSH_KNOWN_HOSTS` | Git host keys; without it the agent remembers the host key on the first connection and checks against it later |
| `NOLAY_S3_ENDPOINT`, `NOLAY_S3_BUCKET`, `NOLAY_S3_ACCESS_KEY`, `NOLAY_S3_SECRET_KEY` | storage for backups |

## Troubleshooting

| What you see | Why | What to do |
|---|---|---|
| The app does not see a variable | The key starts with `NOLAY_` | Rename the key |
| Code `no_secrets_key` | The server has no encryption key | Run the install command again |
| You need a saved value | The panel does not keep it | Take the value from its source (password manager, service console) and set it again if needed |

## Next

Read [what is stored where](/en/concepts/data/).