Secrets and variables

Every function in a project's environment reads the same variables and secret files. They belong to the project's functions runtime, a service named functions-runtime, and they stay on our servers, encrypted at rest.

3 min read

Set a variable

From the CLI, name the functions-runtime service. With no value, the CLI asks for it in a hidden prompt, so a key never lands in your shell history. --secret keeps it masked everywhere it is shown.

Terminal

bash

naijacloud env set PAYSTACK_SECRET_KEY --service functions-runtime --project shop --secret

Load several at once from a local .env file:

Terminal

bash

naijacloud env import .env --service functions-runtime --project shop

List and remove them:

Terminal

bash

naijacloud env ls --service functions-runtime --project shop
naijacloud env rm OLD_KEY --service functions-runtime --project shop

If the project has functions in more than one environment, add --env <name>. Each environment has its own runtime and its own variables, so a prod key never reaches dev.

In the dashboard, after the first deploy: open any function and choose Edit project variables on its Overview. That opens the runtime's Variables tab, where you can also add secret files.

Read it in your code

const key = process.env.PAYSTACK_SECRET_KEY;    // Node style
const key = Deno.env.get("PAYSTACK_SECRET_KEY"); // Supabase / Deno style

A function's Overview lists the variable names it can read, never the values.

Changes apply on the next deploy

A changed variable reaches your functions the next time you deploy one of them. After env set, redeploy:

Terminal

bash

naijacloud functions deploy paystack-webhook --project shop

Before your first function, and after your last

The functions-runtime service is created by a project's first function deploy, so deploy once before you set variables. Deleting a project's last function removes the runtime, and its variables and secret files go with it, so an empty project isn't billed. Set them again after you deploy a function there next.

Never put a secret in your frontend's environment variables, such as NEXT_PUBLIC_ or VITE_ ones. Those are built into the JavaScript every visitor downloads. Keep the key in a function and call the function instead.