aura functions and aura secrets
Every `aura functions` and `aura secrets` command, with its options, the files it reads and the environment it needs.
1. Setup
Commands that talk to your project need three things:
| Need | How |
|---|---|
| A session | aura login, then aura link --project-id <uuid>, which writes aurabase.toml |
| The project URL | AURA_PROJECT_URL, or project_url in aurabase.toml |
A service_role key | AURA_API_KEY or AURA_SERVICE_ROLE_KEY, in the environment or in a .env file |
| Variable | Default | Role |
|---|---|---|
AURA_GATEWAY_URL | https://api.aurabase.cloud | Management API used by login, orgs and projects. Set it explicitly when you work against another stack: the default is the hosted cloud. |
AURA_PROJECT_URL | project_url of aurabase.toml | Data plane of your project |
AURA_STUDIO_URL | http://localhost:3000 | Studio opened by aura studio |
Without AURA_GATEWAY_URL, aura login and aura projects create talk to https://api.aurabase.cloud. Export the URL of your own stack before you test against it.
2. aura functions
aura functions new <name> [--runtime deno|wasm]
Creates aurabase/functions/<name>/. The default runtime is deno (TypeScript template with index.ts and deno.json). With --runtime wasm it creates a Rust crate (Cargo.toml, src/lib.rs). It refuses an existing name.
aura functions serve [name] [--port 54321]
Runs index.ts or index.js with deno run --allow-net --allow-env --allow-read --watch, so the function restarts when you save. It needs Deno installed; without it, the command explains how to install it. With no name, it lists local functions.
The server listens on http://127.0.0.1:<port> and the function receives the request as it would in production (method, path, headers, body), without the platform: no x-aura-* identity headers, no secrets, no limits. PORT and DENO_SERVE_ADDRESS are set for you, so a plain Deno.serve(handler) uses the chosen port.
A WASM function cannot be served locally: the command prints how to deploy it.
aura functions deploy <name>
Reads index.ts (or index.js) and sends it to the project, creating or replacing the function. Existing secrets are kept. For a function without index.ts or index.js, it runs cargo build --target wasm32-unknown-unknown --release and sends the compiled binary.
A Deno function is a single file: the command refuses relative imports (./helper.ts, ../lib.ts). Use remote imports (npm:<package> or https://esm.sh/<package>) or inline the code.
aura functions invoke <name> [--data '<json>']
Calls the deployed function and prints the response envelope. --data is the request body. A --data that is not valid JSON is an error: it is not replaced by {}.
aura functions list [--json]
Lists local functions with their runtime (Deno / TypeScript or Rust / WASM) and, when a project is linked, the deployed ones with actif or inactif.
aura functions logs <name> [--limit 50]
Lists recent HTTP requests for the function: time, method, path, status, duration and request id. It does not show the output of your code (console.log). See limits.
aura functions download <name>
Writes the deployed code to aurabase/functions/<name>/: index.ts for a Deno function, <name>.wasm for a WASM one. The Rust source of a WASM function is not stored on the server.
aura functions delete <name> [--force]
Deletes the deployed function after a confirmation. --force (or -f) skips the confirmation, which you need in scripts.
3. aura secrets
| Command | Effect |
|---|---|
aura secrets list --function <name> [--json] | Lists the keys; values are masked (sk_l***) |
aura secrets set --function <name> KEY=VALUE … | Adds or updates keys, keeps the others |
aura secrets unset --function <name> KEY … | Removes keys |
--function can be written -f. These commands store values as given and do not encrypt them: see secrets and environment for the encrypted path.