scribase secrets

Environment secrets are encrypted at rest and bound into every edge function in the environment, where a function reads them with Deno.env.get('NAME'). Changing a secret reaches deployed functions without a redeploy: the next request after the change runs with the new value.

Usage

Terminal

scribase secrets list  <org> <project> <env>
scribase secrets set   <org> <project> <env> <NAME> [<value> | --from-env VAR | --stdin]
scribase secrets unset <org> <project> <env> <NAME>

set needs exactly one value source:

Source	Example
`--from-env VAR`	`scribase secrets set acme store production STRIPE_KEY --from-env STRIPE_KEY`
`--stdin`	`printf %s "$KEY" \| scribase secrets set acme store production STRIPE_KEY --stdin`
A literal value	`scribase secrets set acme store production FEATURE_FLAG on`

Prefer --from-env or --stdin: a literal value lands in your shell history and the process list. A trailing newline on standard input is not part of the secret.

Rules

Names are letters, digits and underscores, starting with a letter or underscore. Names beginning with SCRIBASE_ are reserved for the platform.
Values are 1 byte to 64 KiB.
list shows names and versions, never values.
set on an existing name rotates it and bumps its version.

The response's functions_refreshed field is true once the running functions have the change. If the functions runtime could not be reached, the change is still saved, a warning is written to the environment's logs, and functions pick it up on their next deploy.