Variables & secrets

Environment variables, secret values, and how they reach your code.

Configuration, not code

A function's variables are delivered as its entire environment. Your code reads them the ordinary way:

$apiUrl = getenv('API_URL');
$secret = getenv('WEBHOOK_SECRET');

Nothing of the platform's environment is present — getenv('DB_PASSWORD'), getenv('APP_KEY') and every other Flares variable return false, because they were never in the process to begin with.

Variables: plain values readable, secret values write-only.

Plain and secret

	At rest	In the console	In your function
Plain	Encrypted	Readable	Available
Secret	Encrypted	Never shown again after saving	Available

Both are sealed with the platform's secret box. The difference is the UI promise: a secret value has no reveal, for you or for Flares staff. To change one, save a new value.

Naming

Letters, digits and underscores, not starting with a digit — API_URL, WEBHOOK_SECRET, STRIPE_MODE. Values up to 32KB.

When changes take effect

On the next invocation. Each invocation is a fresh process, so there is no cache to bust and no restart to perform.

What is audited

Setting or removing a variable records that it changed, by whom and when — never the value. The audit log is not a secret store either.