How to Deploy Replit Securely (2026)

Replit gives you a running app in minutes. The deployment story is just as fast, which is exactly where things go wrong. In our scans of Replit-deployed apps, the two most common issues are secrets hardcoded by Replit Agent (the keys end up in source files that anyone can read if the Repl is public) and API calls made directly from client-side code with no server in between.

Here's how to fix both before you share that URL.

Step 1: Audit for hardcoded secrets

Before anything else, search your source for embedded key values. Replit Agent occasionally hardcodes an API key when generating code to make things work immediately. The output is functional but insecure.

Open the Replit Shell (Tools > Shell) and run:

grep -rn 'sk-\|sk_live_\|Bearer \|api_key\s*=\|API_KEY\s*=' . --include="*.js" --include="*.ts" --include="*.py" --include="*.env"

Also check your .replit and replit.nix config files. Agent sometimes puts values there.

If grep returns any hits with actual key values (not process.env.SOMETHING), those are hardcoded. Rotate the key immediately in the affected service's dashboard (OpenAI, Stripe, Supabase). Treat the existing key as compromised, then move the new key to Secrets.

Step 2: Move all secrets to the Replit Secrets tab

The Secrets tab is Replit's built-in secrets manager. It stores values encrypted, outside your file tree, and excludes them from forks.

How to add a secret:

1. Open your Repl.
2. Click Tools in the left sidebar.
3. Click Secrets.
4. Add a key (e.g., OPENAI_API_KEY) and paste the value.

How to use it in code:

// Replit injects secrets as environment variables at runtime
const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);

import os
openai.api_key = os.environ.get("OPENAI_API_KEY")
stripe.api_key = os.environ.get("STRIPE_SECRET_KEY")

One limit worth knowing: secrets are runtime environment variables. If your code runs client-side in the browser (React, Vue), process.env.OPENAI_API_KEY won't work because the server never runs that code. API keys accessed from the browser need a server-side route (see Step 4).

Step 3: Set Repl visibility to Private

A public Repl is not just a deployed URL. It's a source-code viewer. Any visitor can:

• Navigate to your Repl URL
• Click the Files icon in the sidebar
• Read every file in your project

That includes your Express routes with any secrets you missed, your database connection strings, and any config files.

How to change visibility:

1. Click your Repl name at the top of the workspace.
2. Open Settings.
3. Change Visibility to Private.

Free accounts support private Repls. There's no reason to leave a production app public.

Step 4: Move API calls server-side

This is the issue that survives even if you use the Secrets tab correctly.

When you call an API from client-side JavaScript (React components, vanilla JS in the browser), that code runs on the user's device. Any value it uses (including values from process.env in a bundled Vite or React app) gets baked into the JS bundle that the browser downloads.

The fix is a server-side route that holds the API key and acts as a proxy:

// server.js -- runs on Replit's server, not in the browser
app.post('/api/generate', async (req, res) => {
  const { prompt } = req.body;
  const response = await fetch('https://api.openai.com/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.OPENAI_API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      model: 'gpt-4o',
      messages: [{ role: 'user', content: prompt }]
    })
  });
  const data = await response.json();
  res.json(data);
});

Your frontend then calls /api/generate. It never sees the key.

This applies to: OpenAI API keys, Stripe secret keys, Supabase service_role keys, and any high-permission credential. The Supabase anon key is designed to be public with proper RLS rules, so that one is fine in client-side code.

Step 5: Configure a custom domain and verify HTTPS

Replit's .repl.co subdomain works fine and comes with a TLS certificate. For production, a custom domain looks more professional and gives you more control.

Add a custom domain in your Repl's Settings > Custom Domain. Replit handles the TLS cert automatically via Let's Encrypt.

Two things to verify after deployment:

1. HTTP redirects to HTTPS. Test by navigating to http://yourdomain.com (it should redirect to https://). If you're running Express, add this:

if (process.env.NODE_ENV === 'production') {
  app.use((req, res, next) => {
    if (req.headers['x-forwarded-proto'] !== 'https') {
      return res.redirect(301, `https://${req.headers.host}${req.url}`);
    }
    next();
  });
}

2. Security headers are present. Add the helmet package to set CSP, HSTS, X-Frame-Options, and others automatically:

const helmet = require('helmet');
app.use(helmet());

Step 6: Scan the live URL before sharing

Source code review catches hardcoded keys. A live URL scan catches a different set of issues: secrets embedded in your JS bundle, missing security headers, open CORS policies, and exposed stack traces in error responses. These only appear after deployment.

A note on Replit Agent

If you used Replit Agent to build your app, check its generated code for these patterns before deploying:

• API keys as string literals: const apiKey = 'sk-proj-...';
• .env files with actual values committed (Agent sometimes creates these with placeholder values replaced by real ones from the conversation context)
• console.log statements that print secret values during startup

Agent is good at functional code. It optimizes for "working now" over "secure by default". The security pass is yours to do.