Skip to main content
Use the Box dashboard for secrets. Open Dashboard > Secrets and add the values your Boxes need. Dashboard secrets are applied to Boxes as:
  • environment variables, available to processes and shell sessions inside the Box
  • secret files, written under the Box work directory using the relative paths you configure
The dashboard is the preferred path for app credentials, API keys, .env files, deployment tokens, and other runtime configuration. Do not pass secrets in prompts, URLs, CLI arguments that may be logged, Docker build args, or committed files.

​
Add Environment Variables

  1. Open Dashboard > Secrets.
  2. Add shell-style lines in the environment variables editor:
OPENAI_API_KEY=...
DATABASE_URL=...
  1. Save.
New Boxes receive the variables when they start. When you save changes, Box also pushes the updated environment to existing Boxes that are still active (provisioned, cloning, ready, idle, or running) and have a live machine connection. Stopped, archived, deleted, or unreachable Boxes pick up the latest values the next time they are started or resumed.

​
Add Secret Files

Use secret files for .env, JSON credentials, or config files that a repo expects on disk.
  1. Open Dashboard > Secrets.
  2. Add a secret file with a relative path such as ariana-ide-private/backend/.env, .env, or config/secrets.json.
  3. Paste the file contents and save.
Repositories selected in Dashboard > Repositories are cloned into /home/user on the hosted Box image. Folder names use the GitHub repository name, not the owner/name pair. For example, ariana-dot-dev/ariana-ide-private is cloned to: 
/home/user/ariana-ide-private
The secrets dashboard does not have a repository selector. Secret file paths are relative to the Box work directory, which is /home/user on the hosted Box image. To write a backend .env file into ariana-ide-private, include the repository folder in the path: 
ariana-ide-private/backend/.env
Box writes the file to: 
/home/user/ariana-ide-private/backend/.env
Secret file paths must be relative. Unsafe absolute paths and paths that escape /home/user are skipped.

​
Programmatic Setup

For setup scripts, configure secrets in the dashboard first, then run your setup in the Box. The script can read normal environment variables or files at the configured paths. 
box_id="$(box new --json | jq -r 'select(.event == "ready") | .id')"
box ssh "$box_id" -- bash -s < ./setup.sh
box ssh <id> <command> runs the command non-interactively and streams stdin, stdout, and stderr, so setup scripts do not need to be copied to a temporary path in the Box. In Windows PowerShell, prefer running this from Node, Python, WSL, Git Bash, or cmd.exe. Native PowerShell pipelines can keep stdin open for native executables in some environments. Only use temporary uploaded env files for one-off local experiments. For normal usage, dashboard secrets keep the workflow auditable and avoid leaking values through logs or command history.