> ## Documentation Index > Fetch the complete documentation index at: https://docs.replit.com/llms.txt > Use this file to discover all available pages before exploring further. # Add secrets to environments > Connect external secrets managers to your development environment using Replit's open-source OIDC modules, short-lived credentials, and provider policies. Choose your provider below and give Replit its configuration to connect your secrets manager and save it to your [reusable environment](https://docs.replit.com/build/code/create-reusable-environment.md). Replace the example identifiers with your development resources and configure the provider's trust and permissions first. To access private packages instead of secrets, select **JFrog Artifactory**. The modules configure short-lived provider credentials; they do not automatically load secrets into your app. ## Connect a provider > [tab] AWS Secrets Manager > > ```yaml theme={null} > repos: > - repo: https://github.com/replit/dev-modules > ref: main > path: dev-modules > build: > - run: >- > bash ./dev-modules/aws-oidc/build.sh > --role-arn=arn:aws:iam::123456789012:role/replit-development > --region=us-east-1 > ``` > > Prerequisites: Register `https://sts.replit.com` as an AWS OIDC provider with audience `sts.amazonaws.com`, and create the role above. > Restrict its trust to your Replit workspace and grant read access to the required secrets. > See the [detailed AWS instructions](https://github.com/replit/dev-modules/tree/main/aws-oidc). > > Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. > [tab] Infisical > > ```yaml theme={null} > repos: > - repo: https://github.com/replit/dev-modules > ref: main > path: dev-modules > build: > - run: >- > bash ./dev-modules/infisical-oidc/build.sh > --identity-id="" > --project-id="" > --environment=dev > ``` > > Prerequisites: Create a machine identity with JWT authentication using Replit's JWKS, audience `infisical`, and your [workspace's `org_id`](https://github.com/replit/dev-modules/tree/main#how-oidc-works). > Give it read access to the intended project's development environment and paths. > See the [detailed Infisical instructions](https://github.com/replit/dev-modules/tree/main/infisical-oidc). > > Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. > [tab] Azure Key Vault > > ```yaml theme={null} > repos: > - repo: https://github.com/replit/dev-modules > ref: main > path: dev-modules > build: > - run: >- > bash ./dev-modules/azure-oidc/build.sh > --client-id="" > --tenant-id="" > --subscription-id="" > ``` > > Prerequisites: Create a managed identity or app registration trusting `https://sts.replit.com`, with audience `api://AzureADTokenExchange` and subject [`//replit.com/customer//org/`](https://github.com/replit/dev-modules/tree/main#how-oidc-works). > Grant it read access to the development Key Vault secrets. > See the [detailed Azure instructions](https://github.com/replit/dev-modules/tree/main/azure-oidc). > > Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. > [tab] HashiCorp Vault > > ```yaml theme={null} > repos: > - repo: https://github.com/replit/dev-modules > ref: main > path: dev-modules > build: > - run: >- > bash ./dev-modules/vault-oidc/build.sh > --address=https://vault.example.com > --role=replit-development > ``` > > Prerequisites: Create a JWT role trusting Replit, bound to your [workspace's `org_id`](https://github.com/replit/dev-modules/tree/main#how-oidc-works) and the Vault hostname as its audience. > Give it read access to the intended secret paths, and ensure the Vault server is reachable from the environment. > See the [detailed Vault instructions](https://github.com/replit/dev-modules/tree/main/vault-oidc). > > Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. > [tab] JFrog Artifactory > > ```yaml theme={null} > repos: > - repo: https://github.com/replit/dev-modules > ref: main > path: dev-modules > build: > - run: >- > bash ./dev-modules/jfrog-oidc/build.sh > --platform-url=https://example.jfrog.io > --provider-name=replit > --audience=jfrog-replit > ``` > > Prerequisites: Use a JFrog deployment with OIDC integration enabled. [JFrog's OIDC integration documentation](https://docs.jfrog.com/administration/docs/openid-connect-integration) lists support with Enterprise X and Enterprise+ licenses. > Have a JFrog administrator create a **Generic OpenID Connect** integration with these settings: > > * **Provider Name:** `replit`, matching `--provider-name`. > * **Provider URL:** `https://sts.replit.com`. > * **Token Issuer:** Optional; if supplied, use `https://sts.replit.com`. > * **Audience:** `jfrog-replit`, matching `--audience`. > > Add an identity mapping with the following **Claims JSON**: > > ```json theme={null} > { > "iss": "https://sts.replit.com", > "aud": "jfrog-replit", > "org_id": "" > } > ``` > > Replace `` with the `org_id` claim from a Replit workload token in the workspace that will run the environment. > It identifies your Replit workspace, not your JFrog organization. > Replit supplies `iss` and `org_id` in the signed token; the module requests the audience passed through `--audience`. > Do not match fixed `iat` or `exp` values, which change between tokens. > Avoid a full sandbox-specific `sub` if new sandboxes should inherit access. > > Grant the mapping only the repository permissions your workflow needs. > For strict group-scoped permissions, leave **Username** blank to avoid permissions inherited through automatically joined groups. > Use the platform origin for `--platform-url`, without `/artifactory`. > Add `--project-key=` when selecting project-scoped identity mappings. > See the [detailed JFrog instructions](https://github.com/replit/dev-modules/tree/main/jfrog-oidc) for setup and [Replit token claims](https://github.com/replit/dev-modules/tree/main#how-oidc-works). > > Ask Agent to load the generated environment settings and use the authenticated `jf` wrapper: > > ```bash theme={null} > source ~/.config/replit-oidc/env.sh > jf rt ping > ``` > > The wrapper exchanges a Replit workload token for a short-lived JFrog token and refreshes the cached token before commands when needed. > Use `jf npm`, `jf pip`, `jf mvn`, or `jf docker` after configuring the required repositories for that tool. > Bare `npm`, `pip`, `mvn`, and `docker` commands are not automatically authenticated by this module. > For direct API access, the `jfrog-token` helper returns a bearer token; keep its output out of logs and chat. > [tab] Google Secret Manager > > ```yaml theme={null} > repos: > - repo: https://github.com/replit/dev-modules > ref: main > path: dev-modules > build: > - run: >- > bash ./dev-modules/gcp-oidc/build.sh > --workload-identity-provider=projects/123456789/locations/global/workloadIdentityPools/replit/providers/replit-oidc > --service-account=replit-dev@my-project.iam.gserviceaccount.com > --project=my-project > ``` > > Prerequisites: Create a Google workload identity provider trusting `https://sts.replit.com`, restricted to your Replit workspace. > Its allowed audience must match `//iam.googleapis.com/`, using the full resource name passed to `--workload-identity-provider`. > Allow it to impersonate the service account above, and grant that account Secret Manager access. > See the [detailed Google instructions](https://github.com/replit/dev-modules/tree/main/gcp-oidc). > > Ask Agent to retrieve the secrets your app needs from the connected provider and configure your app to use them. Tell Agent where to look, such as a specific project, vault, or secret path. > [!NOTE] > > For non-interactive app commands, ask Agent to load `~/.config/replit-oidc/env.sh` and follow the runtime instructions in the linked provider README. > CLI authentication does not guarantee SDK authentication or credential refresh. Vault and Infisical CLI helpers do not supply credentials to unrelated SDK processes. > [accordion] Need a secret for only this chat? > > Ask Agent to add a secret by name, without typing its value in your message. For example: > > ```text theme={null} > This app needs DEVELOPMENT_API_KEY. Ask me to add it securely for this chat. > ``` > > Agent can open a secure elicitation form for you to enter the value. The secret is stored securely and scoped to the private chat, rather than placed in your prompt or committed to Git. Use a development credential with only the permissions required; confirm the variable name and scope shown by the form before submitting. Do not assume a chat-scoped secret is available in a different chat or in a reusable environment build. > > ![Secure secret-entry form with an empty value field.](https://mintcdn.com/replit/Scz0QdkCm-76dARz/images/code-contributions/chat-secret-elicitation.png?fit=max\&auto=format\&n=Scz0QdkCm-76dARz\&q=85\&s=0a259e2853c5ec254f1bfb9c58de097b) > > Alternatively, select **+** in the editor tab bar, then **Secrets**. > > ![The editor's new-tab menu with Secrets highlighted.](https://mintcdn.com/replit/ZvLiuMLrojYoqf3I/images/code-contributions/open-secrets-tab.jpg?fit=max\&auto=format\&n=ZvLiuMLrojYoqf3I\&q=85\&s=9dfd78422324f9c2c7742688b6ab8c81) > > Select **New Secret**, enter the **Key** and **Value**, and select **Add Secret**. Enter credentials in the form, never in chat. > > ![The Add Secret form with Key and empty Value fields.](https://mintcdn.com/replit/bwyNlFMrtiNdFQiG/images/code-contributions/add-secret-form.jpg?fit=max\&auto=format\&n=bwyNlFMrtiNdFQiG\&q=85\&s=128c3e3878cdfb9e92c569a08d729c07)