# Manage secrets

On the project's **Secrets** page, choose the environment's tab and the folder in the tree. Any
member of the workspace can add, reveal, change and delete secrets. See
[Secrets overview](https://www.mocco.club/docs/en/articles/8yrkb2-overview) for environments and folders.

## Add a secret

1. Choose **Add secret**.
2. Enter the **Key**, the name your app reads, such as `DATABASE_URL`. A key is letters, digits and
   `_`, and doesn't start with a digit.
3. Enter the **Value**. For a value with several lines, such as a private key, tick **Multi-line
   value** first to get a larger field.
4. Optionally add a **Comment** and **Tags**. To make a new tag, type its name under the tags and
   choose **Add tag**.
5. Choose **Add secret**.

![The Add a secret form: key, value, multi-line value, comment and tags](https://fi-workers-mocco-storage.s3.ap-northeast-2.amazonaws.com/pub/w/93e11fe8-0494-4e3d-b1cb-fe4dffd3ee7e/p/d64785b8-9a23-4fa1-a81d-550af30e203a/helpcenter/10c31265-6c18-4662-b21f-fbedf13dac08/secrets-add.png)

## Reveal and copy

Values are hidden until you ask for them. **Reveal** shows one value; **Reveal all** shows every
value in the folder. A revealed value hides again after a minute, when you choose **Hide**, or when
you move to another folder or environment.

**Copy** puts one value on your clipboard without showing it on screen.

Each reveal, copy and export is recorded in the workspace's [audit log](https://www.mocco.club/docs/en/articles/2yiscf-audit-log) with
the keys and folder, never the values.

![A folder's secrets with one value revealed and the others hidden](https://fi-workers-mocco-storage.s3.ap-northeast-2.amazonaws.com/pub/w/93e11fe8-0494-4e3d-b1cb-fe4dffd3ee7e/p/d64785b8-9a23-4fa1-a81d-550af30e203a/helpcenter/8c4f400b-932e-4f0e-a6a9-38c179ccc565/secrets-revealed.png)

## Change or delete a secret

**Edit** changes a secret's comment, tags or multi-line setting without revealing its value. To give
it a new value, tick **Change the value** and enter it. Each new value becomes a new version, shown
as `v2`, `v3` and so on next to the key.

**Delete** removes the secret from the folder; choose **Confirm delete** to go ahead. Its earlier
values stay in the folder's history, and setting the same key again brings it back.

## Import a .env file

You can add or update many secrets at once from a `.env` file or a JSON object.

1. Choose **Import .env**.
2. Paste the file's contents, or choose the file.
3. Choose **Preview**. Nothing changes yet. The preview lists each key as **New**, **Changed** or
   **Unchanged**, with fingerprints instead of values, so you can check what the import does.
4. Choose **Set** to apply it.

![The import preview: new, changed and unchanged keys with their fingerprints, and the Set button](https://fi-workers-mocco-storage.s3.ap-northeast-2.amazonaws.com/pub/w/93e11fe8-0494-4e3d-b1cb-fe4dffd3ee7e/p/d64785b8-9a23-4fa1-a81d-550af30e203a/helpcenter/63c279bb-61aa-43ff-8a7f-3d07cddbcfaa/secrets-import.png)

What the import reads:

- `.env` lines like `KEY=value`, with or without `export ` in front. Lines starting with `#` and
  blank lines are skipped, and ` # …` after a bare value is a comment.
- Values in double quotes, where `\n`, `\t`, `\"` and `\\` mean a new line, a tab, a quote and a
  backslash, and values in single quotes, taken as they are. A quoted value can span several lines.
- A JSON object of keys and values, such as `{"PORT": 8080}`. Numbers and `true`/`false` are kept as
  text.

A line that isn't valid is listed with its line number, and nothing is set until it is fixed. If a
key appears twice, the last value is used. One import sets at most 500 secrets. Comments and tags
of existing secrets stay as they are.

## Export a folder

**Export .env** downloads the folder's secrets as a `.env` file, such as `production-api.env`.
Values are quoted only where needed, and the file imports back to the same values. Exporting reveals
every value in the folder, so it is recorded in the audit log like a reveal.