# Secrets overview

**Secrets** keeps your project's environment variables and secrets — database URLs, API tokens,
signing keys — in one place, separately for each environment your app runs in. Every value is
encrypted with a key that belongs to your project alone. Values stay hidden in the console until
someone reveals them, and every reveal is recorded in your workspace's
[audit log](https://www.mocco.club/docs/en/articles/2yiscf-audit-log) with who, which keys and which folder, never the values.

Secrets is in preview: it isn't listed on the **Products** page yet. An owner or admin can turn it
on for a workspace through [Mocco's MCP server](https://www.mocco.club/docs/en/articles/frhj3w-connect) with the `mocco_products_enable`
tool and the product `secrets`. The project then has a **Secrets** page.

## Environments

A project starts with three environments: **Development**, **Staging** and **Production**. They are
created the first time someone opens the **Secrets** page. Each one keeps its own secrets, so
`DATABASE_URL` can point at a different database in each.

![The Secrets page: environment tabs with their secret counts, the folder tree on the left and the root folder's secrets with masked values](https://fi-workers-mocco-storage.s3.ap-northeast-2.amazonaws.com/pub/w/93e11fe8-0494-4e3d-b1cb-fe4dffd3ee7e/p/d64785b8-9a23-4fa1-a81d-550af30e203a/helpcenter/294ba282-bda8-4e8f-a59c-e09478ab600f/secrets-environments.png)

Owners and admins can add an environment, such as `preview` or `qa`: choose **Add environment**,
enter a **Name** (the **Slug** is suggested from it), then **Add**. A slug is lower-case letters,
digits and hyphens. A project has at most 25 environments.

## Folders

Within an environment, secrets live in folders, starting at the root `/`. Use folders to group what
belongs together, such as `/api` and `/api/stripe`. The tree on the left shows the environment's
folders with the number of secrets in each, and the path above the list shows where you are.

To add a folder, type its name under the tree and choose **Add**: it goes under the folder you are
in. A folder name is letters, digits, `_` and `-`, up to ten levels deep. **Delete this folder**
removes the folder you are in with every folder and secret inside it; choose it a second time to
confirm.

## Compare environments

**Overview** shows the folder you are in across every environment at once: a row for each key and a
column for each environment.

![The overview: each key's fingerprint in each environment, with "Missing in some" and "Values differ" marked](https://fi-workers-mocco-storage.s3.ap-northeast-2.amazonaws.com/pub/w/93e11fe8-0494-4e3d-b1cb-fe4dffd3ee7e/p/d64785b8-9a23-4fa1-a81d-550af30e203a/helpcenter/4824d162-1411-43ef-9f0a-63743d488037/secrets-overview.png)

- **Missing** means that environment doesn't have the key; **No folder** means it doesn't have the
  folder at all. A key missing somewhere is marked **Missing in some**.
- Each cell shows the value's **fingerprint**, a short code computed from the value with your
  project's key. Equal values share a fingerprint, so **Values differ** marks a key whose value isn't
  the same everywhere — without revealing any value. A fingerprint says nothing about the value
  itself.

The overview reveals nothing, so it isn't recorded in the audit log.

## Next

[Manage secrets](https://www.mocco.club/docs/en/articles/yebc3m-manage-secrets): add, reveal, copy, change and delete secrets, and import or
export a `.env` file.