November 2026

A secret bound to an app now reaches it the way it reaches a sandbox or an agent's shell: a secret holding TELEGRAM_BOT_TOKEN, bound as TELEGRAM, is read as TELEGRAM_BOT_TOKEN. The binding's name is what app.bindings() lists it by, and each binding's variables names what the code reads. An app's environment holds a name once, so a key that another bound secret holds, or that another binding, the app's own secrets or settings or NoClick sets, is refused with Conflict when you bind it, naming the key and both sides. A secret can gain a key after it's bound, so a deployment that finds a clash fails with the same words.