Before real customer data goes into a Replit app

6 steps, in order.

1. 01

   Keys go in Secrets, never in the code

   Replit's Secrets tool encrypts API keys, tokens and database connection strings and hands them to the app as environment variables. Check who can see them: Replit documents that collaborators and workspace owners can see secret values, while people who remix the project see only the names.

2. 02

   Use a real database, and know how to restore it

   Replit provides a managed PostgreSQL database, with a development database separate from the one the published app uses, and documents restoring the database to an Agent checkpoint. Decide where a second copy of the data lives as well, and try a restore once before you need it.

3. 03

   Choose how the app is published

   Replit documents four publishing types: Autoscale, which adjusts to usage; Static, for sites that do not change with user input; Reserved VM, which runs continuously on a fixed amount of computing power; and Scheduled, which runs at times you choose. A website and an always on automation server usually want different ones.

4. 04

   Decide who owns the workspace and the bill

   Settle whose Replit account the app lives in, who pays for it, and who can add or remove people, before the app holds anything important. Moving ownership later is possible, but it is easier when nobody is depending on the app yet.

5. 05

   Put a ceiling on the agent bill

   Replit documents usage limits that block usage based services once they are reached, a Plan Mode where Agent plans without changing code, and Agent modes that trade cost against capability. Set a limit before a long build, not after the invoice.

   • Teams that already pay for their own AI coding tools can connect an editor to the app over SSH, which Replit offers on its paid plans.

6. 06

   Logins, roles and a second pair of eyes

   A first version often has one user who can do everything. Before launch, decide who can see and change each kind of record, then have somebody who reads code check the parts that handle money, personal details and permissions.