# Store secrets
URL: https://docs.awellhealth.com/docs/extensions/store-secrets

> For the complete documentation index, see [llms.txt](https://docs.awellhealth.com/llms.txt).



> Secrets and environment variables are not stored in extension code. They go in
> [extension settings](/docs/extensions/extension-settings) instead.

Declare the setting in code, then read it in the extension's custom actions.

## How a secret reaches an action [#how-a-secret-reaches-an-action]

1. The extension code defines the setting, marked `obfuscated: true`.
2. The person installing the extension enters the value securely in the Awell platform.
3. The action reads it from the payload at run time.

The code never contains the secret, only the *name* of a setting whose value someone else supplies.

## The same setting holds different values per environment [#the-same-setting-holds-different-values-per-environment]

Awell supports multiple environments, such as Sandbox and Production, and the same setting can hold a
different value in each.

An extension installed in Sandbox points at a test account while the same extension in Production points
at the real one, with no code difference.

## Settings arrive in the onEvent payload [#settings-arrive-in-the-onevent-payload]

Settings arrive in the `onEvent` payload alongside the action's field values. See
[The onEvent function](/docs/extensions/on-event).

## Next steps [#next-steps]

**Next:** [Create an action](/docs/extensions/create-an-action).