> ## Documentation Index
> Fetch the complete documentation index at: https://docs.newly.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Production and secrets

> Deploy your Newly Backend to production with the newly CLI, and keep API keys out of your app.

In Newly v2, at app.newly.app and in Newly for Mac, your [Newly Backend](/backend/overview) has a dev environment and a production environment. The agent builds and tests on dev. Moving your backend to production is a step you take yourself.

## Why the agent can't deploy to production

The agent in your chats works on your **dev** backend. It can't deploy to production, change production secrets or read production logs. If it tries, it gets "Managed Newly agent sessions can operate only on the dev backend".

This keeps your live app safe from changes made while you're still building. To ship to production, you use the newly CLI (command-line tool) on your own computer, signed in as yourself. You need to be the project's owner or have **Admin** access to it.

## Deploy your backend to production

You need a terminal and Node 20 or later.

<Steps>
  <Step title="Install the newly CLI">
    ```bash theme={null}
    npm i -g @newly/cli
    ```
  </Step>

  <Step title="Sign in">
    ```bash theme={null}
    newly login --email
    ```

    You can also use `--google` or `--github`. Use the same account you use in the web app or the Mac app.
  </Step>

  <Step title="Download the latest code">
    In an empty folder, run:

    ```bash theme={null}
    newly pull <project-id>
    ```

    Your project id is the last part of the web app address: `app.newly.app/projects/<id>`. This downloads the dev branch, which is where the agent works. See [Get your code](/code/get-your-code) for the options.
  </Step>

  <Step title="Deploy to production">
    From the folder you pulled, run:

    ```bash theme={null}
    newly deploy --env prod
    ```

    The command deploys the `backend/` folder on your computer. If your project doesn't have a production backend yet, the command sets one up first.
  </Step>
</Steps>

<Warning>
  `newly deploy` ships the code in your folder, not the code in Newly. If the agent has made changes since you pulled, run `newly pull <project-id> --force` before you deploy. `--force` replaces the files in the folder and discards your local changes, so don't keep your own edits there.
</Warning>

## Secrets and API keys

A secret is a private value your backend needs, such as a payment provider key or a Google sign-in client secret.

### Don't paste secrets into a chat

The agent won't take a secret pasted into a chat. Set secrets with the newly CLI instead.

### Set a dev secret

From a freshly pulled project folder, run:

```bash theme={null}
newly secrets set KEY VALUE --service api
newly deploy --env dev
```

* Use `--service api` for keys your app's own server code uses.
* Use `--service auth` for sign-in keys, such as `GOOGLE_CLIENT_ID`. See [Sign-in for your app](/backend/app-sign-in).
* **Always pass `--service api` or `--service auth`.** The default doesn't work, and the command fails with "service must be api or auth".
* A secret takes effect on the next deploy. `newly deploy --env dev` also deploys your local `backend/` folder, so pull the latest code first.

To see which secrets are set, run `newly secrets list --service api` (or `--service auth`).

### Production secrets

The newly CLI sets secrets for dev. For production secrets, contact support. See [Getting help](/help/getting-help).

If the tool says production secrets require the Newly web app, that screen doesn't exist. Contact support instead.

### Public settings in your app

Some values aren't secret, such as your backend's public address. These go in your app's `app.json` under `expo.extra`.

Never put a secret inside your app. Anyone can extract values from an app they've downloaded. Keep secrets on your backend and let your backend call the other service.

### The Credentials panel is not for app keys

In the Mac app, **Settings** → **Credentials** holds keys for the agent and its tools, such as your Claude, OpenAI or Expo credentials. It doesn't send keys to your app or your backend, even if the agent points you there. Use `newly secrets set` for your app's keys.

## Dev-only commands

These commands work for dev only:

| Command                                    | What it does                                    |
| ------------------------------------------ | ----------------------------------------------- |
| `newly secrets list` / `newly secrets set` | Show or set backend secrets                     |
| `newly db url`                             | Print a read-only address for your dev database |
| `newly logs`                               | Show recent logs from your dev backend          |

## Creating a backend-only project needs credits

`newly create` makes a new backend-only project from the command line. It needs a positive credit balance. With no credits, it shows "You do not have any credits left." Add credits and try again. See [Running out of credits](/billing/out-of-credits).

## Related

<CardGroup cols={2}>
  <Card title="Get your code" icon="download" href="/code/get-your-code">
    Install the newly CLI and download your project.
  </Card>

  <Card title="AI features in your app" icon="wand-magic-sparkles" href="/backend/ai-models">
    Let your app use AI models, and what that costs.
  </Card>
</CardGroup>