My Replit Secrets work in the workspace but not in the published app. Why?

• The app works in Preview, but the published .replit.app address or your own domain shows a blank page, an error page, or “Internal Server Error”.
• The deployment logs say a value is undefined, “not found” or “missing”, for example OPENAI_API_KEY is not set.
• Sign-in, sign-up or payments fail only on the live app.
• The live app can't reach its database, or shows the test data you used in the workspace.
• In Publishing you see “The value of this secret differs from the workspace value”.
• You added a secret, pressed Publish, and the app still behaves as if it isn't there.

1. Two separate lists. Replit keeps the workspace Secrets and the published app's secrets apart. Its help page says they are “separate environments” and “changing one doesn't update the other”. So a key you added in the workspace after your first publish, or a key you changed later, may not be in the published app.
2. The live list has the wrong value. Many apps use a test key while building (for example a Stripe test key) and a live key once published. If the live list still holds the test key, or the other way round, payments or sign-in fail. A DATABASE_URL that points to the development database makes the live app show or change your test data.
3. The change never reached the running app. The published app only picks up new values when a new deployment starts. Saving a secret is not enough. You have to press Publish again.
4. A duplicate or old key is used instead. On the Replit forum, one founder's site was down for 5 days because an old development DATABASE_URL in the deployment secrets kept overriding the production one. Another found their app was using a key with the same name from a different project.
5. The app is a Static deployment. Replit says secrets are available “for all deployment types except Static Deployments”. A Static deployment has no server, so it can't read secrets at all. Apps made with Replit Agent need Autoscale or Reserved VM.
6. The value is copied into the page when it's built. If your app's front end reads a value like VITE_SUPABASE_URL, that value is copied into the page files when the app is built. Changing it later does nothing until you publish again. Never put a secret key in a VITE_ value: anyone can read it in the page code.

1. Find the exact error

Open Publishing and look at the logs of the live deployment. Find the first line that says ERROR, undefined, not found or missing. Note the name of the key it mentions. If the live app opens but a page fails, open that page and note what it says.

2. Open the published app's secrets

In Publishing, select Adjust settings and find Production app secrets (also called Deployment secrets).

Then open the workspace list: Tools → Secrets (under Setup).

3. Compare the two lists, key by key

For each key in the workspace Secrets:

• Missing from Production app secrets? Add it with the same name.
• Different value? Decide which one the live app should use. Use live keys for payments and email in the published app, and the production database address for DATABASE_URL.
• Same name twice, or an old key you no longer use? Remove the old one, so only one value remains.

Check the names letter by letter. STRIPE_SECRET_KEY and STRIPE_SECRET are different keys.

If you change many at once with Edit as JSON or Edit as .env, check the full list before saving. Replit says bulk editing replaces the existing secrets.

Settings that are not secret (a public web address, a feature switch) belong under Configurations. Replit lets you add a value for the published app only with New published app configuration.

4. Check the deployment type

Still in Adjust settings, look at Deployment type. If it says Static and your app has sign-in, a database or payments, change it to Autoscale. Static deployments can't read secrets.

5. Publish again

Press Publish. Replit builds and publishes the app again even if no code changed. The new values only count once the new deployment has started.

6. Test the live app, not Preview

Open the published address in a private window. Then:

• sign up with a new email address,
• log out and log in again,
• open the payment page and check the Pay button shows.

If a sign-in provider such as Google or Supabase still fails, its settings may also need your live address as an allowed redirect. That is a separate step from secrets.

Paste this into Replit Agent (or another AI tool). Replace the parts in brackets first.

My Replit app works in Preview but fails after publishing.
Live address: [your .replit.app address or domain].
What I see on the live app: [error message or what happens].
First error line from the deployment logs: [paste it].

Please:
1. List every environment variable and secret this app reads (server code and front-end code),
   and say which ones the published app needs.
2. Tell me which of those I must add or correct in Publishing > Adjust settings > Production app secrets,
   and which ones should use a live value instead of a test value (payments, email, database).
3. Tell me if any secret key is read in front-end code (for example a VITE_ value) and move it to the server.
4. Check the deployment type and tell me if it should be Autoscale instead of Static.
5. Add a clear startup message that names any missing key, without printing its value.
Don't print or log any secret values. Don't change the database or delete any data.
After I add the secrets, I will press Publish and test sign-up, log-in and payment on the live address.

A missing or wrong secret often shows up only on the live app, and only on the pages that use it: sign-in, sign-up or payment. The home page can open fine while those pages fail, so a quick look after publishing may not catch it.

Heedza's monitoring for Replit apps opens your published app from the outside on a schedule and checks that your home, sign-up, log-in and payment pages open and show their forms or Pay button. It checks that the site is online every 5 minutes on Free, every minute on Solo and Starter, and every 30 seconds on Pro and Business, and opens those pages once a day on Free and up to every 15 minutes on paid plans. If a page stops working, it sends you a screenshot and a fix to paste into your AI tool. Heedza never logs in, fills in forms or pays, and it can't see your secrets, so it tells you which page broke, not which key is wrong.