Secrets
Secrets are values that belong to your app (API keys, tokens, connection strings), kept out of your source code. Your pages, loaders, actions and API routes read them as environment variables.
Reading a value
const key = process.env.STRIPE_KEY;
process.env only holds the variables declared for your site, plus a few neutral ones such as
NODE_ENV and TZ. Each site sees its own values: two apps on the platform never read each
other's variables.
Declaring values
Non-secret settings go in the [env] block of bext.config.toml:
[env]
NODE_ENV = "production"
PUBLIC_BASE_URL = "https://my-app.inklura.fr"
bext.config.toml lives in your source tree: never put a real secret there. Secret values are
provided to your app by the platform, outside your repository, and appear in process.env
alongside the [env] values. When both define the same name, the [env] value wins.
Changes to [env] are picked up without a restart.
The SDK secrets namespace
The createSdk client (see the SDK Overview) exposes secrets.get(key),
typed Promise<string | null>. It never throws and returns null when nothing is found.
import { createSdk } from "@bext-stack/framework/sdk";
const sdk = createSdk("<app-id>");
const token = await sdk.secrets.get("WEBHOOK_TOKEN"); // string | null
sdk.secrets.get(name) returns a secret the platform provisioned for your app, or null when
there is none. For your own values (API keys, tokens), read process.env as shown above.
Where to next
| Page | What it covers |
|---|---|
| SDK Overview | The createSdk client |
| Config Reference | bext.config.toml |
| KV Store | Durable string store |