Aurabase Logo
aurabasedocs
docs›Edge Functions›Secrets and environment

Secrets and environment variables

How to pass a Stripe key or any setting to a function without writing it in the code, and what the platform actually protects.

6 min read·Level intermediate·Revised on Oct 12, 2026
This English text was generated automatically from the French original and has not been reviewed yet.
#
Write

1. Set a variable

Every variable belongs to one function. Setting variables needs a service_role key.

terminalbash
aura secrets set --function checkout STRIPE_SECRET_KEY=sk_live_… WEBHOOK_SECRET=whsec_…
aura secrets list --function checkout     # values are masked: STRIPE_SECRET_KEY  sk_l***
aura secrets unset --function checkout WEBHOOK_SECRET
terminalbash
curl -X PUT "$AURA_URL/v1/functions/checkout/env" \
  -H "apikey: $AURA_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"vars":[{"key":"STRIPE_SECRET_KEY","value":"sk_live_…"}]}'

PUT /env replaces the whole set of variables with the list you send. aura secrets set and unset read the current values, change the keys you name and write the result back.

Redeploying keeps your secrets

Deploying new code with aura functions deploy leaves the variables untouched.

#
Read

2. Read it in the function

aurabase/functions/checkout/index.tstypescript
Deno.serve(async (req) => {
  const key = Deno.env.get('STRIPE_SECRET_KEY')
  if (!key) return new Response('STRIPE_SECRET_KEY is not set', { status: 500 })
  // …call Stripe with `key`
  return Response.json({ ok: true })
})

Variables are read at every invocation: a change applies to the next call.

#
Injected

3. Variables the platform adds

VariableValue
AURABASE_PROJECT_IDThe project id. Always set.
AURABASE_FUNCTION_NAMEThe function's name. Always set.
AURABASE_URLThe platform URL, when the platform operator defines it.
AURABASE_ANON_KEYA platform key, when the operator defines it.

You cannot override these names. The host's environment is not visible to your function: in a real run Deno.env.get('PATH') returned undefined.

To call your own project from a function, store a service_role key as a secret of that function and send it in the apikey header of an HTTP request. Never forward the key of a user, and never put a service_role key in a browser.

#
Protection

4. What is encrypted

PathEncrypted at rest
PUT /v1/functions/{name}/envYes, if the service has an encryption key configured (FN_ENV_ENCRYPTION_KEY, AES-256-GCM). Without it, values are stored as sent and the service logs a warning at start.
aura secrets set / unsetNo: the CLI writes through PATCH, which stores the values as sent.
env_vars in a deploy requestNo, same reason.

In our local test, a value written by PUT /env was returned unchanged by the function's definition, because no key was configured.

Ask your platform operator before relying on encryption

Whether secrets are encrypted depends on the deployment, and only the PUT /env path can encrypt them. The CLI path stores them as given. Until the CLI uses PUT /env, use the HTTP call above for production secrets.

Reading secrets back is restricted too. GET /v1/functions/{name}/env returns the decrypted values and, like GET /v1/functions/{name}, requires a service_role key. A public key receives 403.

#
Rules

5. Rules to follow

  • Never hard-code a secret in index.ts. The source code of a function is stored in your project and returned to any service_role caller.
  • Never log a secret. The output of console.log ends up in the runtime's logs.
  • Use one variable per function, with the narrowest key that works (a restricted key from your provider, not the master key).
  • Rotate a key by setting the new value and redeploying nothing: the next call uses it.
Last updated · Oct 12, 2026