> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rigbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets and generated credentials

> Supply deployment credentials without committing their values to the manifest.

## Forward a local secret

Declare the name, then supply its value in your local environment or ignored `.env` file before deploying:

```yaml theme={null}
secrets:
  - name: WEBHOOK_SECRET
  - name: APP_TOKEN
    from: LOCAL_APP_TOKEN
```

A missing required value fails deployment before release submission. Use `optional: true` only if the application handles an absent value. Resolved secrets override matching `env` entries. Never paste actual credentials into documentation, command history, or source control.

## Generate an application credential

Credentials use a **named map**, not a list:

```yaml theme={null}
credentials:
  admin_token:
    generate: true
    envVar: ADMIN_TOKEN
```

Without `envVar`, the injected name is `CRED_ADMIN_TOKEN`. Incremental deployment requires `generate: true`; supply externally managed credentials through `secrets` or `env`. Keep environment names valid and distinct.

## Deploy and verify

Run `rig deploy --workspace my-project` locally. Confirm the app accepts its credential through its normal authenticated flow. Do not print the value to prove injection succeeded.

The `secrets` declaration prevents storing a value in `rig.yaml`; it does not make app environment metadata an encrypted vault. Authorized environment/API readers can access stored values. Rotate a disclosed credential and redeploy, then revoke the old value at its provider if applicable.

For Actions, map a GitHub repository secret into the deployment step's `env`; see [GitHub Actions](/guides/github-actions#application-environment-values).