Secrets and environment variables for serverless functions
Set per-function environment variables from the test panel (Config → Environment) or the API — values are injected into the container at runtime, and common secret-shaped strings are redacted from logs and traces. Built for function configuration, not as a standalone enterprise secrets manager.
Related guides and docs
Get started free →How it works
Configure, invoke, read from env
Add environment variables
In the editor test panel, open Config and expand Environment — or call updateFunction with an envVars map. Values are stored on the function record in the app database.
Invoke the function
On every invocation the platform merges layer and function variables and passes the result into the runtime environment.
Read in your handler
Read values with process.env, os.environ, or os.Getenv, exactly like any other deployment. Avoid logging raw credentials — redaction helps, but it is not a full secrets manager.
Features
Sensitive values without hardcoding in source
Per-function env vars
Configure keys and values for each function without touching code, and the UI's password-style inputs reduce shoulder-surfing while you type.
Runtime injection
Gateway calls, jobs, and manual runs all supply environment variables to the container through the same injection path.
Log and trace redaction
Common secret patterns — tokens, passwords, API keys — are masked in persisted logs and traces wherever redaction runs.
Pair with your deployment pipeline
For long-lived production credentials, inject values from CI/CD or the host environment to keep the database surface area small — function env vars are best for values you accept storing on the function record.
Example
Set environment variables, use them in your function
// Per-function env vars (Config → Environment in the editor, or API): await api.updateFunction("function-id", { envVars: { OPENAI_API_KEY: "sk-...", }, }); // Values are stored on the function and injected into the container at invoke time
export async function handler(event, context) { // OPENAI_API_KEY comes from function env — avoid logging it const payload = typeof event.body === 'string' ? JSON.parse(event.body || '{}') : (event || {}); const { prompt } = payload; const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY, }); const completion = await openai.chat.completions.create({ model: "gpt-4o-mini", messages: [{ role: "user", content: prompt }], }); return { statusCode: 200, body: JSON.stringify({ result: completion.choices[0].message.content }), }; }