> ## Documentation Index
> Fetch the complete documentation index at: https://docs.novita.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I keep API keys safe inside a Novita Sandbox?

> Store keys as Novita Sandbox Secrets. Code in the sandbox sees only a placeholder; the real value is injected into HTTPS headers for hosts you allow.

Store the key as a Novita Sandbox **Secret** and pass it with `secret_envs` instead of `envs`. Code in the sandbox only sees a placeholder like `novita_secret_<hex>`; the real value is added only to HTTPS request headers sent to hosts you allow.

## Details

| | `envs` | `secret_envs` |
| - | - | - |
| What the sandbox sees | The real value | A placeholder (`novita_secret_<hex>`) |
| Where the real value appears | Anywhere the code puts it | Only in HTTPS request header values (for example `Authorization`, `X-Api-Key`) to allowed hosts |
| Real value stored in snapshots or templates | Possibly | No |
| Storage | Passed per sandbox | Encrypted, scoped to your team |

* Substitution applies to HTTPS header values only — not request bodies, URL paths, query strings, plain HTTP, or WebSocket messages.
* The same variable name can't be used in both `envs` and `secret_envs`.
* Secrets are available in v2 regions.

## How to

```python Python icon="python" theme={"system"}
import os
from novita_sandbox import Novita

novita = Novita()
novita.secret.create(
    name="openai-key",
    value=os.environ["OPENAI_API_KEY"],
    hosts=["api.openai.com"],
)

sandbox = novita.sandbox.create(secret_envs={"OPENAI_API_KEY": "openai-key"})
print(sandbox.commands.run("echo $OPENAI_API_KEY").stdout)  # prints a placeholder
```

```js JavaScript & TypeScript icon="js" theme={"system"}
import { Novita } from 'novita-sandbox'

const novita = new Novita()
await novita.secret.create({
  name: 'openai-key',
  value: process.env.OPENAI_API_KEY,
  hosts: ['api.openai.com'],
})

const sandbox = await novita.sandbox.create({ secretEnvs: { OPENAI_API_KEY: 'openai-key' } })
console.log((await sandbox.commands.run('echo $OPENAI_API_KEY')).stdout) // prints a placeholder
```

Learn more: [Secrets](https://docs.novita.ai/guides/sandbox-secret.md) · [Use secrets in a sandbox](https://docs.novita.ai/guides/sandbox-secret-sandbox-use.md)

## Related questions

* [How is Novita Sandbox isolated?](https://docs.novita.ai/guides/sandbox-faq-isolation.md)
* [Can I restrict internet access from a Novita Sandbox?](https://docs.novita.ai/guides/sandbox-faq-internet-access.md)
* [Which regions does Novita Sandbox run in?](https://docs.novita.ai/guides/sandbox-faq-regions.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.