Secrets
Secrets are app-scoped values — API keys, tokens, connection strings — stored out of your source tree. They are reachable over the loopback SDK and exposed to your app as environment variables.
JS API
import { createSdk } from "@bext-stack/framework";
const sdk = createSdk("<app-id>");
const apiKey = await sdk.secrets.get("STRIPE_KEY");
The secrets namespace exposes get(key).
Endpoints
Scoped by X-Bext-App-Id (see SDK Overview):
| Endpoint | Method | Query / body | Returns |
|---|---|---|---|
/secrets/get |
GET | ?key= |
the secret value |
/secrets/list |
GET | — | secret names only |
/secrets/set |
POST | key + value | — |
/secrets/delete |
POST | key | — |
curl -s "http://127.0.0.1/__bext/sdk/secrets/get?key=STRIPE_KEY" \
-H "X-Bext-App-Id: <app-id>"
Note
/secrets/list returns names only, never the values. Read a value with
/secrets/get?key= or sdk.secrets.get(key).
Also exposed as environment variables
Secrets are additionally exposed to the app as environment variables, so you can read one without a round trip:
const key = process.env.STRIPE_KEY;
Tip
Prefer the env-var form for values you need at startup or on a hot path; use
sdk.secrets.get (or /secrets/get) when you need to fetch a secret dynamically at
runtime.
Where to next
| Page | What it covers |
|---|---|
| SDK Overview | The loopback SDK model |
| Cache | TTL scratch cache |
| KV Store | Durable string store |