Why This Matters
Your Replit code files can be viewed by anyone you share your project with and potentially by others depending on your project settings. If you paste an API key directly into a code file -- "const apiKey = 'sk_live_xxxx'" -- that key is visible to anyone who sees the code. For keys that cost money when used (Stripe, OpenAI, Anthropic), this is a serious security risk.
Environment variables solve this problem. The key is stored separately from your code, encrypted by Replit, and injected into your app's environment when it runs. Your code references the key by name, not by value. The actual key value never appears in your code files.
The rule: every API key, every database password, every secret token goes in Replit Secrets. No exceptions. The thirty seconds it takes to add a secret instead of pasting it in code is worth it every time.
How to Add a Secret in Replit
Click the padlock icon in the left sidebar of the Replit editor. Click New Secret. Name it clearly -- STRIPE_SECRET_KEY, ANTHROPIC_API_KEY, DATABASE_URL. Paste the value. Click Save. The secret is now available in your code as process.env.STRIPE_SECRET_KEY (or whatever you named it).
How to Reference Secrets in Code
When Claude writes code that uses an API key, it uses process.env.KEY_NAME automatically -- Claude knows the convention. If you ever see a Claude-generated code snippet with a key pasted directly, ask it to replace that with the environment variable reference instead.