Secrets and Environment Files

Your deployed app needs API keys and other secret values. Cofounder stores them and delivers them to your app. Secrets your own machine needs (to run the app locally, or to reach Cofounder) stay in local env files and environment variables.

Set App Secrets

App secrets are the values your deployed app reads: third-party API keys, webhook secrets, anything that would sit in a production env file.

secrets set prompts for the value or reads it from --stdin, so the value never lands in your shell history. secrets list shows key names and details only. Values can't be read back.

To keep a value out of the chat, enter it yourself on the company's Secrets page, using the App, Marketing, or Development link from company_get. Your agent can then check key names and setup with secrets_list.

Saving a value doesn't check a running deployment. Running apps and sandbox processes can keep using the old value after you change or delete it.

Calling the API Directly

Send an authenticated bearer token and X-Organization-Id with every request. Writes need a destinations list:

• app and marketing each update production and staging and try to redeploy.
• development makes the secret available to development sandboxes.
• Destinations you leave out keep their current value.

Have your secret source write the JSON request to a protected file, then send that file so the value stays out of shell history:

curl --fail-with-body https://api.cofounder.co/cofounder-cli/v1/secrets \
  -H "Authorization: Bearer $COFOUNDER_API_TOKEN" \
  -H "X-Organization-Id: $COFOUNDER_COMPANY_ID" \
  -H 'Content-Type: application/json' \
  --data-binary @/secure/path/secret-request.json

The request has to follow these rules:

• Use HTTPS for remote endpoints.
• Names are uppercased, with hyphens turned into underscores. Names starting with COFOUNDER_ are reserved and can't be written.
• Destinations must be non-empty with no repeats.

Check the Result and Recover

An HTTP 200 doesn't mean every write saved, so check each POST result:

• Success: success: true, error_code: null, and writes entries with destination, scope, and status: "saved".
• Partial: success: false, error_code: "write_incomplete", listing which scopes saved and which are unknown.
• resources_unavailable: fix the destination's setup before writing.
• Invalid requests return a redacted 422 response.

The CLI exits 1 for partial or unknown outcomes and doesn't retry on its own. To recover, send the same value again. That can trigger another redeploy. HTTP retries should keep the same destinations. If a delete fails, retry it to remove the remaining copies. If a response is lost, the metadata can't tell you whether the write landed.

Set Database Secrets

Edge functions on the managed Supabase project have their own secret store:

Keep Local Secrets in Env Files

Secrets for the app running on your machine stay out of Cofounder. Keep them in the repo's gitignored env file (.env.local, .env) and never commit them. Anything the deployed app needs belongs in secrets instead.

CLI Environment Variables

Export them in your environment. The CLI never reads repo env files for its own credentials.

To run more than one company, see Multiple Companies.