World map

 

BM

World C3: Release & Deploy

Secrets per environment

You will learn: how to give staging and production their own keys, so one leak can't open both.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Staging and production share one deploy token. A staging test script goes wrong. What can it break?

Watch

Give each kitchen its own locked spice box. An environment secret: A secret only jobs that name that environment can read. Each kitchen's own locked spice box. opens only for jobs that name that environment. Sort these secret: The locked spice box: private info like a token. Never put it in code..

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      The token now lives only in the production environment. The deploy is red. Read the real error. Then pick a fix for the yellow line.

      The line is red. Fix the yellow lines, then run again.

      What happened on GitHub

      Workflow file .github/workflows/deploy.yml

      name: Deploy
on:
push:
branches: [main]
permissions:
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: npm ci
- run: npm run deploy
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

      Yellow: lines 9–9. You can change these.

      Pick a fix

      The line

      Push to main · main

      Predict

      Production also has a required reviewer. When can the deploy job read production’s secrets?

      Check

      Key habits: good, or needs work?

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      A different token for staging and for production.

      You did it!

      You can now keep each environment’s keys in its own box.

      Go deeper (optional)

      Self-hosted runners can read environment secrets too, so guard them well (World C4). On private repos, environment secrets need GitHub Pro, Team or Enterprise.

      Real rep (optional): in a public test repo, make staging and production environments. Give each its own test token with gh secret set CLOUDFLARE_API_TOKEN --env staging.