> For the complete documentation index, see [llms.txt](https://docs.release.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.release.com/reference-documentation/environment-settings/environment-specific-environment-variables/managing-secrets.md).

# Managing legacy Release Secrets

Learn how to create and edit secret environment variables for your Release environments

{% hint style="danger" %}
This section refers to a legacy implementation of secrets storage in Release. We HIGHLY recommend using the new [secret vaults](/reference-documentation/environment-settings/environment-specific-environment-variables/secrets.md) implementation for secrets. The legacy implementation is kept for backward compatibility or for lightweight "obscured" data that is not highly sensitive. Secrets created in the legacy format are automatically converted to RSM secrets. Please refer to the secret vaults page for up-to-date usage.
{% endhint %}

Secret environment variables allow your environments to securely access passwords, API keys, and other sensitive information.

Secrets differ from other environment variables in two ways:

* Secrets are encrypted and saved in a vault.
* Secrets are always hidden from Release's interface.

Secrets can be created and updated using Release's YAML editor. If you are using GitOps, you can check the **keys** for your secrets in along with the rest of your environment variables and code, and then define the **values** using the UI, keeping your secrets separate from your code.

## How to create secret environment variables in Release

As with all environment variables, secret environment variables can be added by editing an app's [default environment variables](/reference-documentation/application-settings/default-environment-variables.md), or by editing an environment's [environment-specific environment variables](https://github.com/releasehub-com/docs/blob/main/reference-documentation/environment-settings/environment-specific-environment-variables.md).

1. In Release, edit the environment variables:
   1. To add application-specific secrets that apply as defaults to all new environments, navigate to the App Settings page. Click the **Edit** button in the “Default Environment Variables” section.
   2. To add environment-specific secrets, navigate to the environment's Settings page. Click the **Edit** button in the “Environment Variables” section.
2. Add `secret: true` to the environment variable's declaration.
3. Click **Save as new version** to save your changes.

![Adding a secret environment variable](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-c2b1a2d370a6dc1db2c4fc5e0b949ee0c73d9836%2Fmanaging-secrets-create-secret.png?alt=media\&token=528dd9bf-35ff-42e9-923b-dd868764874b)

Release will now encrypt and save the secret in the vault.

## How to edit secret environment variables in Release

Unlike other environment variables, secret values are always hidden in Release's YAML editor.

To edit an existing secret, add a `value` field with your new value.

1. In Release, edit the environment variables:
   1. To edit application-specific secrets that apply as defaults to all new environments, navigate to the App Settings page. Click the **Edit** button in the “Default Environment Variables” section.
   2. To edit environment-specific secrets, navigate to the environment's Settings page. Click the **Edit** button in the “Environment Variables” section.
2. Add a `value` field to the environment variable's declaration.
3. Add the new secret value to the `value` field.
4. Click **Save as new version** to save your changes.

![Editing a secret environment variable](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-3a2fd32c5ad7e5f56fb3e2ab5b34736d0036a4be%2Fmanaging-secrets-edit-secret.png?alt=media\&token=533d2471-e6fc-498f-a19a-f35b47f4d5b9)

Release will now encrypt and save the updated secret in the vault.

### How to apply updated secrets to an environment in Release

{% hint style="info" %}
If you are editing an environment-specific secret, a further step is required before applying your new configuration.
{% endhint %}

Before Release compares a new configuration to the previous version, secrets are removed from the YAML files. This means that from Release's point of view it may look like nothing has changed, even though the secret value saved in the vault has changed.

To make sure Release knows you've changed a secret, add or change any non-secret environment variable. For example, add a new environment variable with key `SECRET_CHANGED` and increase its value by 1 every time you change a secret.

Once you're done editing your environment-specific environment variables, click the **Apply** button in the “Apply Latest Configuration” section.

Release will now re-deploy this environment with updated environment variables.

## How to access secrets from your app

Secret environment variables can be accessed just as you would access any other environment variable.

For example, access a secret environment variable from Python with `os.environ`:

```python
import os
password = os.environ.get('DB_PASSWORD')
```

To view secret environment variables in the [terminal](/guides-and-examples/running-instances/using-terminal.md) for debugging, open a terminal for a running instance, and print the secret value using `echo $DB_PASSWORD`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.release.com/reference-documentation/environment-settings/environment-specific-environment-variables/managing-secrets.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.