# scribase secrets

Environment secrets are encrypted at rest and bound into every edge function in
the environment, where a function reads them with `Deno.env.get('NAME')`.
Changing a secret reaches deployed functions without a redeploy: the next
request after the change runs with the new value.

## Usage

```sh
scribase secrets list  <org> <project> <env>
scribase secrets set   <org> <project> <env> <NAME> [<value> | --from-env VAR | --stdin]
scribase secrets unset <org> <project> <env> <NAME>
```

`set` needs exactly one value source:

| Source | Example |
|---|---|
| `--from-env VAR` | `scribase secrets set acme store production STRIPE_KEY --from-env STRIPE_KEY` |
| `--stdin` | `printf %s "$KEY" \| scribase secrets set acme store production STRIPE_KEY --stdin` |
| A literal value | `scribase secrets set acme store production FEATURE_FLAG on` |

Prefer `--from-env` or `--stdin`: a literal value lands in your shell history
and the process list. A trailing newline on standard input is not part of the
secret.

## Rules

- Names are letters, digits and underscores, starting with a letter or
  underscore. Names beginning with `SCRIBASE_` are reserved for the platform.
- Values are 1 byte to 64 KiB.
- `list` shows names and versions, never values.
- `set` on an existing name rotates it and bumps its version.

The response's `functions_refreshed` field is `true` once the running functions
have the change. If the functions runtime could not be reached, the change is
still saved, a warning is written to the environment's logs, and functions pick
it up on their next deploy.