Your Replit secrets got deleted and the agent swears it wasn't there

You open your Replit project and the app is dead. DATABASE_URL is missing. Maybe your Stripe key, your OpenAI key, half the Secrets tab. You ask the agent what happened and it says it never touched them, so your mind goes to the scary place: someone got into my account. Almost certainly not. This is the agent's own doing, and it is one of the most common Replit failure patterns right now. The good news: every one of those secrets is recoverable, and most of them in minutes. The one thing that makes it worse is asking the agent to put them back. Do not do that. Here is the whole picture.

What actually happened

The Replit Agent can edit and delete workspace Secrets while it debugs. When a fix attempt involves environment variables, it sometimes rewrites them, clears them, or deletes ones it decides are "unused". Then a detail that makes this feel like a break-in: each agent chat has no memory of your other chats. The chat that deleted your secrets was probably a different session from the one you are asking now. So when the current chat says "I did not delete anything", it is not lying to you. It genuinely has no record of it. Users see "deleted by unknown actor" and assume a hacker. The unknown actor was the agent, in a chat that no longer remembers.

One more trap: checkpoint rollback does not save you here. Rolling back to an earlier checkpoint restores your CODE, not your Secrets. Secrets live outside the checkpointed files. So you can roll back all day and DATABASE_URL stays gone.

Step 1: figure out which secrets are missing

Open the Secrets tab (the lock icon in the left toolbar, or search "Secrets" in the tools search). Your missing secrets fall into two buckets, and they come back two different ways:

1. Replit-managed database variables. These are the ones Replit created for you when you added a database: DATABASE_URL, PGHOST, PGUSER, PGPASSWORD, PGDATABASE, PGPORT. You never typed these in, so you cannot retype them. But Replit still knows them.
2. Third-party keys you pasted in yourself. Stripe, OpenAI, SendGrid, Twilio, Resend, Google, anything from an outside service. Replit does not know these. The provider does.

Write down the list of what is gone before fixing anything. You want to know when you are done.

Step 2: restore the database variables from the Database pane

Replit's built-in database is Neon Postgres under the hood, and your actual database was not deleted; only the environment variables pointing at it were. Open the Database tab (search "Database" in the tools search, or the database icon in the toolbar). That pane shows your database's live connection info and re-injects the standard variables into your workspace. In most cases just opening the pane brings DATABASE_URL and the PG* variables back. If they do not reappear automatically, the pane displays the connection details and you can copy them into Secrets yourself, exactly as shown. Your data is untouched. This is a five minute fix.

Step 3: restore third-party keys by hand, from each provider

For every outside service, log into that service's own dashboard and copy the key fresh:

1. Stripe: dashboard.stripe.com, Developers, then API keys. Note that secret keys are only shown once at creation; if you cannot reveal yours, create a new restricted or secret key and use that.
2. OpenAI: platform.openai.com, API keys. Old keys cannot be re-viewed, so create a new one.
3. SendGrid, Twilio, Resend, and the rest: same pattern. Provider dashboard, API keys section, copy or regenerate.

Paste each one into the Secrets tab yourself, by hand, with the exact same NAME the app expects (STRIPE_SECRET_KEY, OPENAI_API_KEY, whatever your code reads). The name matters as much as the value. If you are not sure what names your app expects, search your code for process.env. or os.environ and list what comes up.

The one rule: never ask the agent to restore secrets

This is the mistake that turns a 20 minute recovery into a lost week. If you tell the agent "my Stripe key is missing, fix it", it does not know your key. So it does what it always does when it does not know something: it produces something plausible. You end up with sk_live_xxxxx... shaped strings that look completely real and work exactly never. Then your payments fail with authentication errors, you ask the agent to debug THAT, and it starts rewriting your payment code to chase a bug that is really just a made-up key. Secrets go in by hand. Every time. The agent can tell you which secret NAMES the code expects; it must never supply the values.

Prevent the next one

1. Keep an off-Replit list of your app's secret names. A plain note is fine: "This app needs DATABASE_URL, STRIPE_SECRET_KEY, OPENAI_API_KEY, SENDGRID_API_KEY." Names only. Next time something vanishes, you know in one glance what to check.
2. Keep the values in a password manager. 1Password, Bitwarden, anything. Then a wiped Secrets tab is a paste job, not an archaeology dig.
3. Rotate anything you suspect was exposed. If a secret did not just vanish but got moved around, printed in logs, or written into a code file by the agent, treat it as leaked. Generate a fresh key at the provider and delete the old one. This matters most for anything touching money.

Also stuck on publish with database errors?

If on top of the missing secrets your publishes are failing with database errors, that is a separate, live problem: Replit has had an ongoing incident since September 1 where publish is blocked by development database connection checks even when production is healthy. That one has its own unblock, including a workaround using your own free Neon database. Read the publish-failing database guide.

Do not do this

Do not delete the project or the database thinking you were hacked; you would be destroying data that is perfectly fine. Do not roll back checkpoints hoping secrets come back; they will not, and you may lose good code. And do not let the agent "investigate the security breach". There was no breach, and the investigation will invent one.

Still stuck?