shield_lock
JinDaGe
← Back to skills
extension
Category: Development & EngineeringNo API key required

set-secret

Sets SST secrets for deployed environments. Use when configuring Clerk, database, Stripe, or webhook secrets.

personAuthor: jakexiaohubgithub
open_in_newRepositorydownloadDownload package

Set SST Secret

Manages secrets stored in AWS SSM Parameter Store for SST deployments.

Commands

Set a Secret

npx sst secret set <SecretName> "<value>" --stage <stage>

List Secrets

npx sst secret list --stage dev

Remove a Secret

npx sst secret remove <SecretName> --stage dev

Required Secrets by Component

Backend (back/sst.config.ts)

| Secret | Description | Example | |--------|-------------|---------| | DbConnStr | PostgreSQL connection string | postgresql://user:pass@host:5432/db | | ClerkSecretKey | Clerk backend secret | sk_test_... or sk_live_... | | ClerkWebhookSecret | Clerk webhook signing secret | whsec_... | | StripeSecretKey | Stripe API key (if using Stripe) | sk_test_... | | StripeWebhookSecret | Stripe webhook signing secret | whsec_... |

# Set backend secrets
npx sst secret set DbConnStr "postgresql://user:pass@host:5432/db" --stage dev
npx sst secret set ClerkSecretKey "sk_test_..." --stage dev
npx sst secret set ClerkWebhookSecret "whsec_..." --stage dev

Frontend (front/sst.config.ts)

| Secret | Description | Example | |--------|-------------|---------| | ClerkPublishableKey | Clerk frontend key | pk_test_... or pk_live_... | | ClerkSecretKey | Clerk backend secret (for SSR) | sk_test_... |

# Set frontend secrets
npx sst secret set ClerkPublishableKey "pk_test_..." --stage dev
npx sst secret set ClerkSecretKey "sk_test_..." --stage dev

Environment-Specific Values

Development (--stage dev)

  • Use Clerk test keys (pk_test_*, sk_test_*)
  • Use Stripe test keys
  • Connect to development database

Production (--stage prod)

  • Use Clerk live keys (pk_live_*, sk_live_*)
  • Use Stripe live keys
  • Connect to production database

Secret Storage

Secrets are stored in AWS SSM Parameter Store:

  • Path: /sst/{app}/{stage}/{secret}
  • Encrypted with AWS KMS

Accessing Secrets in Code

Secrets are declared in sst.config.ts:

const dbConnStr = new sst.Secret('DbConnStr');
const clerkSecretKey = new sst.Secret('ClerkSecretKey');

// Use in Lambda environment
environment: {
  DATABASE_URL: dbConnStr.value,
  CLERK_SECRET_KEY: clerkSecretKey.value,
}

Security Notes

  • Never commit secrets to git
  • Never log secret values
  • Use different values for dev and prod
  • Rotate secrets periodically
  • Clerk keys: test vs live determine environment