Replit works in the editor but Secrets are missing after publish

What it means in plain English

A secret in the Replit editor is an environment variable for that editing session. The published app does not automatically use a different value you only saved for testing. Replit says to review Production app secrets when testing and production need different credentials.

The Secrets tool stores API keys, tokens, and database strings and exposes them as environment variables. Secrets are available for every deployment type except Static Deployments. Configurations are the non-secret settings, and those can be split into a published-app value and a testing value.

REPLIT_DEPLOYMENT is set to 1 when the code is running in a published project, and it is unset in the editor. You can use that to see which environment is running. It does not fill in a missing key.

Likely causes

• The key exists under Secrets in the editor, and Production app secrets was left empty.
• Testing and production were given different values, and the published app is still on the testing one, or on none.
• The value was saved as a configuration in the editor only. A published-app configuration is a separate entry: New configuration, then More, then New published app configuration.
• The deployment is a Static Deployment. Replit says Secrets are not available for that type.
• The code reads a different name from the one you saved. Replit does not rename keys for you.

How to fix it, step by step

1. In the editor, confirm the name the code reads. Open Tools, then Secrets, and check that same name. Use New Secret for a credential. Do not put an API key in Configurations.
2. Open Publishing, select Adjust settings, and locate Production app secrets. Add the name and the value the published app should use. Replit says to review these when testing and production differ.
3. For a non-secret setting that should differ in production, add a published-app configuration: New configuration, More, New published app configuration. Keep secrets out of that section.
4. Publish again after the production values are saved.
5. If the published URL still will not load and the logs mention the listen address, the port check is separate. See Replit deployment fails unless the server listens on 0.0.0.0.

How to check it worked

• The published URL completes the action that needs the key. The editor is not required.
• In the published logs, REPLIT_DEPLOYMENT is 1.
• A secret value does not appear in the page source. It is only in the server environment.

If publishing fails for a reason other than a missing secret, start with Preview and the Publishing logs. See Replit app works in preview but not when published. Rows that exist only in the editor database are a separate production database. See Replit database empty after publish.

An empty name on Vercel or Netlify is the same kind of miss. See Environment variables are undefined in production.

Sources

• https://docs.replit.com/core-concepts/project-editor/app-setup/secrets (opens in a new tab)
• https://docs.replit.com/build/troubleshooting (opens in a new tab)