Hi!
Build-time secrets are indeed a tad different than run-time secrets (due to how we use Docker to build a container image that we later deploy).
We recently added documentation on that (Build Secrets · Fly Docs) as it’s a common point of confusion!
If you’re using a Nixpack or moving from Heroku, it may be a tad different - let me know if that’s the case!)