Secrets

→ Functions and secrets

Studio

Functions → secrets: a NAME and a value in a password field; Set secret. The value is cleared from the form before the request and never rendered anywhere. The list shows names and versions; Delete… removes one.

hcloud

hcloud fn secret set  prj_… API_KEY --file ./api-key.txt   # or --value, or stdin; never echoed
hcloud fn secret list prj_…                                  # names and versions only
hcloud fn secret rm   prj_… API_KEY

curl

curl -X PUT $ORIGIN/v0/projects/$PRJ/functions/secrets/API_KEY -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' -d "{\"value\":\"$(cat api-key.txt)\"}"
curl $ORIGIN/v0/projects/$PRJ/functions/secrets -H "Authorization: Bearer $TOKEN"
curl -X DELETE $ORIGIN/v0/projects/$PRJ/functions/secrets/API_KEY -H "Authorization: Bearer $TOKEN"

JavaScript

await cloud.functions.secrets.set(project.id, "API_KEY", process.env.API_KEY);
const { secrets } = await cloud.functions.secrets.list(project.id);   // [{ name, version, … }]
await cloud.functions.secrets.remove(project.id, "API_KEY");
// cloud.data(...) has no secrets API on purpose.

Inside a function: process.env.API_KEY. Limits: 16 per project, 4 KiB each, names A-Z 0-9 _ starting with a letter. Owner session only.