Cloud: files & API keys

The Cloud tab in the workbench (the cloud icon, next to Code and Preview) holds the two things an app needs that don't belong in your code: uploaded files and API keys.

Files

Drag an image, logo or document into the Files tab and it's uploaded to your own Supabase storage — your account, your files, your control. GenVibe never stores them.

Once uploaded, the AI knows they exist and can use them straight away:

Use my logo in the header and make it the favicon

Because the files are hosted and public, the AI can reference their URLs directly in your code. For things that must exist as a real file on disk — an app icon, a splash screen, anything loaded with require() — it downloads a local copy into the project automatically.

Files live in your Supabase project, so you'll need Supabase connected first. See Supabase.

API keys

The Secrets tab is where you put keys your app needs — Stripe, OpenAI, Resend, anything private.

Add a key and it's encrypted at rest and injected into your app when it runs. Two rules make this safe:

• The AI is told the names of your keys, never the values. It can write code that uses STRIPE_SECRET_KEY without ever seeing it.
• Secret values are never written to disk, so they can't leak into your file list, your downloaded zip, or a GitHub push.

Anything prefixed VITE_ or EXPO_PUBLIC_ is bundled into the app and visible to anyone who uses it — that's how those frameworks work. Use those prefixes only for genuinely public values like a Supabase anon key. Real secrets must not carry them.

Where secrets can be used

A secret key can't be used in browser code — anyone could read it. It has to run on a server, which means an Edge Function:

Add a contact form that emails me with Resend when someone submits it

The AI writes the function, deploys it to your Supabase project, and calls it from your app. Your stored secrets are synced there automatically, so Deno.env.get('RESEND_API_KEY') works with no extra setup.

Account-wide keys

Some keys belong to you rather than to one app — your Expo build token, for example. Those are saved once and work across every project, so you're not re-pasting them each time.

Removing things

Delete a file or a key any time from the same tabs. Deleting a key removes it from your Supabase Edge Function secrets too, so nothing is left behind.

Tips

• Upload your logo before asking for a design — the AI will use it instead of a placeholder.
• Add API keys before asking for the feature that needs them, so the AI can wire it up in one go.
• If the AI says a key is missing, check the name matches exactly — OPENAI_API_KEY and OPENAI_KEY are different keys.