Keep API keys out of your backend scripts

You want a backend script to read a buyer's name out loud with ElevenLabs, and the only place for the API key is the script itself, where anyone who opens it can copy the key.

The enemy is an API key pasted into code.

Backend Scripts Secrets is a new tile in Settings, under Developer. Add a secret with a name (capital letters, digits and underscores), the value, the hosts it may go to, such as api.elevenlabs.io or *.example.com for subdomains, and an optional description. Presets for ElevenLabs, OpenAI, Claude and Gemini fill in the name, host and description and link to the page where you create the key. Use it for services that have no built-in integration: text to speech, AI models, your own APIs.

In a script, put the secret in a request header of http.post, http.get or http.patch, for example 'xi-api-key': env.secret.ELEVENLABS_API_KEY. Every saved secret has an Example button with a ready http.post call that uses it.

The script never holds the key. env.secret.NAME is a placeholder that changes on every run, and the real key is swapped in only inside request headers, only over https, and only for the hosts you allowed. Put it anywhere else, like another host, the URL or the request body, and the request is refused with a message that says why. If a service echoes the key back, the response shows [redacted].

Once saved, nobody can read the value back. The list shows its last 4 characters and when a script last used it, and adding a host means typing the value again.

Try it: open Settings, click Backend Scripts Secrets, click Add secret, pick a preset under Start from, paste your key and click Save secret. Then click Example on the new row and copy the call into a backend script.