# Repl Secrets vs. Account Secrets Best Practices?

**URL:** <https://replit.discourse.group/t/repl-secrets-vs-account-secrets-best-practices/1611>\
**Category:** Deployments\
**Tags:** using-replit, how-to\
**Created:** [January 29, 2025, 8:33pm UTC](https://replit.discourse.group/t/repl-secrets-vs-account-secrets-best-practices/1611 "2025-01-29T20:33:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![daarongonzalez](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/daarongonzalez/32/169_2.png) [@daarongonzalez](https://replit.discourse.group/u/daarongonzalez)\
**Post date:** [January 29, 2025, 8:33pm UTC](https://replit.discourse.group/t/repl-secrets-vs-account-secrets-best-practices/1611/1 "2025-01-29T20:33:38Z")

</div>

Hello everyone!

My name is D’Aaron Gonzalez and I’m so close to launching my first app thanks to Replit Agent, however I’ve created this death loop of mixed matched keys from Stripe testing environments to Live Keys.

I’ve triple checked that the secrets are all set to the correct live key in the Secrets tool. I’ve looked at all the files to make sure it’s not hardcoded anywhere.

Has anyone ran into a similar issue where API keys just don’t change on client-side calls?

---

<div class="post-metadata">

**Author:** ![pmz](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/pmz/32/381_2.png) [@pmz](https://replit.discourse.group/u/pmz)\
**Post date:** [January 29, 2025, 8:50pm UTC](https://replit.discourse.group/t/repl-secrets-vs-account-secrets-best-practices/1611/2 "2025-01-29T20:50:18Z")

</div>

I’m not sure I follow. Did you deploy with testing keys and now updating to stripe API production keys?

---

<div class="post-metadata">

**Author:** ![daarongonzalez](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/daarongonzalez/32/169_2.png) [@daarongonzalez](https://replit.discourse.group/u/daarongonzalez)\
**Post date:** [January 29, 2025, 9:08pm UTC](https://replit.discourse.group/t/repl-secrets-vs-account-secrets-best-practices/1611/3 "2025-01-29T21:08:01Z")

</div>

That is exactly it, the Checkout session is initiated via the PriceID and an API call, however when I switched to production keys the client-side gets and error saying that a live priceID is being initiated with a Test Key.

I started by updating the values in the Secrets tool, and when that didn’t work I moved into other places that may have been storing the key without my knowledge. So far, it seems that it is being pulled from the secrets environmental variable.

---

<div class="post-metadata">

**Author:** ![pmz](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/pmz/32/381_2.png) [@pmz](https://replit.discourse.group/u/pmz)\
**Post date:** [January 29, 2025, 9:15pm UTC](https://replit.discourse.group/t/repl-secrets-vs-account-secrets-best-practices/1611/4 "2025-01-29T21:15:59Z")

</div>

Did you also update the Publishable Key and Secret Key? Those could still be linked to stripe testing environment

---

<div class="post-metadata">

**Author:** ![daarongonzalez](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/daarongonzalez/32/169_2.png) [@daarongonzalez](https://replit.discourse.group/u/daarongonzalez)\
**Post date:** [January 30, 2025, 5:26pm UTC](https://replit.discourse.group/t/repl-secrets-vs-account-secrets-best-practices/1611/5 "2025-01-30T17:26:59Z")

</div>

The way I updated the publishable key and secret key was just by replacing the values in the tool, so my guess is I’ve somehow updated the Keys for the testing environment but not the Prod environment.

I’m not sure if Replit separates these environments, but the API call works with the Webview link when testing, does not work when deployed to the custom domain.