Secrets

Values set with the CLI, never in sproutboat.jsonc, read as a plain string.

Configuration

"secrets": ["STRIPE_KEY"]

Only the binding name goes in the config. Set the value with the CLI after the project’s first deploy:

echo -n "$VALUE" | npx sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
npx sproutboat secrets put STRIPE_KEY --value sk_test_example

echo -n "$VALUE" | pnpm sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
pnpm sproutboat secrets put STRIPE_KEY --value sk_test_example

echo -n "$VALUE" | bunx sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
bunx sproutboat secrets put STRIPE_KEY --value sk_test_example

echo -n "$VALUE" | yarn sproutboat secrets put STRIPE_KEY
# Or, when shell history is not a concern:
yarn sproutboat secrets put STRIPE_KEY --value sk_test_example

Values are stored encrypted, up to 8 KiB each. A new value applies from the next deploy.

Usage

env.STRIPE_KEY // -> plain string

Local and standalone values

• sproutboat dev reads secrets from a .dev.vars file next to sproutboat.jsonc or from the .env files, never both, as wrangler dev does. sproutboat init adds .dev.vars to .gitignore. The process environment is not passed to the app. A declared secret with no value is a warning, and dev still starts. See how dev finds its files.
• A standalone binary reads each secret from the environment variable of the same name. sproutboat run supplies them from env files at launch, and fails to start if a declared secret is missing, like wrangler deploy.

Related

• CLI reference: secrets