Add secrets to environments

Connect external secrets managers to your development environment using Replit’s open-source OIDC modules, short-lived credentials, and provider policies.

Choose your provider below and give Replit its configuration to connect your secrets manager and save it to your reusable environment. Replace the example identifiers with your development resources and configure the provider’s trust and permissions first. To access private packages instead of secrets, select JFrog Artifactory. The modules configure short-lived provider credentials; they do not automatically load secrets into your app.

Connect a provider

AWS Secrets Manager

repos:
  - repo: https://github.com/replit/dev-modules
    ref: main
    path: dev-modules
build:
  - run: >-
      bash ./dev-modules/aws-oidc/build.sh
      --role-arn=arn:aws:iam::123456789012:role/replit-development
      --region=us-east-1

Prerequisites: Register https://sts.replit.com as an AWS OIDC provider with audience sts.amazonaws.com, and create the role above. Restrict its trust to your Replit workspace and grant read access to the required secrets. See the detailed AWS instructions.

Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path.

Infisical

repos:
  - repo: https://github.com/replit/dev-modules
    ref: main
    path: dev-modules
build:
  - run: >-
      bash ./dev-modules/infisical-oidc/build.sh
      --identity-id="<machine-identity-id>"
      --project-id="<project-id>"
      --environment=dev

Prerequisites: Create a machine identity with JWT authentication using Replit’s JWKS, audience infisical, and your workspace’s org_id. Give it read access to the intended project’s development environment and paths. See the detailed Infisical instructions.

Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path.

Azure Key Vault

repos:
  - repo: https://github.com/replit/dev-modules
    ref: main
    path: dev-modules
build:
  - run: >-
      bash ./dev-modules/azure-oidc/build.sh
      --client-id="<client-id>"
      --tenant-id="<tenant-id>"
      --subscription-id="<subscription-id>"

Prerequisites: Create a managed identity or app registration trusting https://sts.replit.com, with audience api://AzureADTokenExchange and subject //replit.com/customer/<customer-id>/org/<org-id>. Grant it read access to the development Key Vault secrets. See the detailed Azure instructions.

Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path.

HashiCorp Vault

repos:
  - repo: https://github.com/replit/dev-modules
    ref: main
    path: dev-modules
build:
  - run: >-
      bash ./dev-modules/vault-oidc/build.sh
      --address=https://vault.example.com
      --role=replit-development

Prerequisites: Create a JWT role trusting Replit, bound to your workspace’s org_id and the Vault hostname as its audience. Give it read access to the intended secret paths, and ensure the Vault server is reachable from the environment. See the detailed Vault instructions.

Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path.

JFrog Artifactory

repos:
  - repo: https://github.com/replit/dev-modules
    ref: main
    path: dev-modules
build:
  - run: >-
      bash ./dev-modules/jfrog-oidc/build.sh
      --platform-url=https://example.jfrog.io
      --provider-name=replit
      --audience=jfrog-replit

Prerequisites: Use a JFrog deployment with OIDC integration enabled. JFrog’s OIDC integration documentation lists support with Enterprise X and Enterprise+ licenses. Have a JFrog administrator create a Generic OpenID Connect integration with these settings:

• Provider Name: replit, matching --provider-name.
• Provider URL: https://sts.replit.com.
• Token Issuer: Optional; if supplied, use https://sts.replit.com.
• Audience: jfrog-replit, matching --audience.

Add an identity mapping with the following Claims JSON:

{
  "iss": "https://sts.replit.com",
  "aud": "jfrog-replit",
  "org_id": "<org-id>"
}

Replace <org-id> with the org_id claim from a Replit workload token in the workspace that will run the environment. It identifies your Replit workspace, not your JFrog organization. Replit supplies iss and org_id in the signed token; the module requests the audience passed through --audience. Do not match fixed iat or exp values, which change between tokens. Avoid a full sandbox-specific sub if new sandboxes should inherit access.

Grant the mapping only the repository permissions your workflow needs. For strict group-scoped permissions, leave Username blank to avoid permissions inherited through automatically joined groups. Use the platform origin for --platform-url, without /artifactory. Add --project-key=<project-key> when selecting project-scoped identity mappings. See the detailed JFrog instructions for setup and Replit token claims.

Ask Agent to load the generated environment settings and use the authenticated jf wrapper:

source ~/.config/replit-oidc/env.sh
jf rt ping

The wrapper exchanges a Replit workload token for a short-lived JFrog token and refreshes the cached token before commands when needed. Use jf npm, jf pip, jf mvn, or jf docker after configuring the required repositories for that tool. Bare npm, pip, mvn, and docker commands are not automatically authenticated by this module. For direct API access, the jfrog-token helper returns a bearer token; keep its output out of logs and chat.

Google Secret Manager

repos:
  - repo: https://github.com/replit/dev-modules
    ref: main
    path: dev-modules
build:
  - run: >-
      bash ./dev-modules/gcp-oidc/build.sh
      --workload-identity-provider=projects/123456789/locations/global/workloadIdentityPools/replit/providers/replit-oidc
      --service-account=[e-mail]
      --project=my-project

Prerequisites: Create a Google workload identity provider trusting https://sts.replit.com, restricted to your Replit workspace. Its allowed audience must match //iam.googleapis.com/<provider-resource-name>, using the full resource name passed to --workload-identity-provider. Allow it to impersonate the service account above, and grant that account Secret Manager access. See the detailed Google instructions.

Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path.

For non-interactive app commands, ask Agent to load ~/.config/replit-oidc/env.sh and follow the runtime instructions in the linked provider README. CLI authentication does not guarantee SDK authentication or credential refresh. Vault and Infisical CLI helpers do not supply credentials to unrelated SDK processes.

Need a secret for only this chat?

Ask Agent to add a secret by name, without typing its value in your message. For example:

This app needs DEVELOPMENT_API_KEY. Ask me to add it securely for this chat.

Agent can open a secure elicitation form for you to enter the value. The secret is stored securely and scoped to the private chat, rather than placed in your prompt or committed to Git. Use a development credential with only the permissions required; confirm the variable name and scope shown by the form before submitting. Do not assume a chat-scoped secret is available in a different chat or in a reusable environment build.

Alternatively, select + in the editor tab bar, then Secrets.

Select New Secret, enter the Key and Value, and select Add Secret. Enter credentials in the form, never in chat.