Bolt.new Missing Secrets and CORS Errors

How to fix it

// try these in order, the most common fix is first

1. FIX 1Add missing secrets

   Copy steps
   1. 01Database icon > Secrets
   2. 02Name exactly as code expects, e.g. OPENAI_API_KEY
   3. 03Save; no redeploy needed
   Did this fix it? Yes No

2. FIX 2Check CORS

   Copy steps
   1. 01Open DevTools Network tab
   2. 02Verify Access-Control-Allow-Origin, -Methods and -Headers in your function
   Did this fix it? Yes No

3. FIX 3Webhooks

   Copy steps
   1. 01Ask Bolt to turn off JWT verification for the webhook function
   2. 02Add your own signature check
   Did this fix it? Yes No

Symptoms

Missing secrets message, blocked requests, webhook rejected.

Why it happens

• C-01Secret not created or misnamed
• C-02CORS not allowing your domain
• C-03Webhook sent without JWT

// this guide also covers

• bolt.new cors error
• bolt.new missing secrets
• bolt.new stripe webhook

The same problem in other apps

All missing or lost data guides →

• Lovable Changes Not Showing After Publish (Lovable)
• Bubble Data Not Showing in Live Version (Bubble)

Other Bolt.new errors

• Bolt.new Tokens Burning Fast
• Bolt.new Error Loop
• Bolt.new Ran Out of Tokens
• Bolt.new Project Too Large to Deploy
• Bolt.new Netlify Publish Failed
• Bolt.new Site Shows 404 After Publishing
• Bolt.new Supabase Connection Not Working
• Bolt.new GitHub Sync Not Working