encore-secret

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Encore Secrets

Encore 密钥管理

Instructions

说明

Secrets are encrypted, environment-scoped values managed by Encore. Declare them at package level by calling

secret(name)

and read them by calling the returned function.

typescript

import { secret } from "encore.dev/config";

// Package-level declaration
const stripeKey = secret("StripeSecretKey");

// Read inside a handler
async function chargeCustomer() {
  const key = stripeKey();        // <-- function call returns the value
  const stripe = new Stripe(key);
  // ...
}

Secret names are globally unique across the application (the same name resolves to the same value everywhere).

Secret 是由 Encore 管理的加密值，并按环境隔离。通过调用

secret(name)

在包级别声明 Secret，再调用返回的函数读取其值。

typescript

import { secret } from "encore.dev/config";

// Package-level declaration
const stripeKey = secret("StripeSecretKey");

// Read inside a handler
async function chargeCustomer() {
  const key = stripeKey();        // <-- function call returns the value
  const stripe = new Stripe(key);
  // ...
}

Secret 名称在整个应用中必须全局唯一（同一个名称在任何位置都会解析为同一个值）。

Setting values

设置值

bash

undefined

bash

undefined

Set per environment type

encore secret set --type prod StripeSecretKey encore secret set --type dev StripeSecretKey encore secret set --type local StripeSecretKey


Environment types: `production` (alias `prod`), `development` (alias `dev`), `preview` (alias `pr`), `local`.

encore secret set --type prod StripeSecretKey encore secret set --type dev StripeSecretKey encore secret set --type local StripeSecretKey


环境类型：`production`（别名 `prod`）、`development`（别名 `dev`）、`preview`（别名 `pr`）、`local`。

Local overrides

本地覆盖

For local development without going through

encore secret set

, create a

.secrets.local.cue

file at the repo root (gitignore it):

cue

StripeSecretKey: "sk_test_local_..."
GitHubAPIToken:  "ghp_local_..."

如需在不执行

encore secret set

的情况下进行本地开发，可在仓库根目录创建

.secrets.local.cue

文件（将其加入 gitignore）：

cue

StripeSecretKey: "sk_test_local_..."
GitHubAPIToken:  "ghp_local_..."

Common usage patterns

常见使用模式

typescript

// HTTP headers
const githubToken = secret("GitHubAPIToken");
const resp = await fetch("https://api.github.com/user", {
  headers: { Authorization: `token ${githubToken()}` },
});

// Webhook signature verification
const stripeWebhookSecret = secret("StripeWebhookSecret");
stripe.webhooks.constructEvent(rawBody, sig, stripeWebhookSecret());

// Connecting to a third-party SDK
const openaiKey = secret("OpenAIKey");
const openai = new OpenAI({ apiKey: openaiKey() });

typescript

// HTTP headers
const githubToken = secret("GitHubAPIToken");
const resp = await fetch("https://api.github.com/user", {
  headers: { Authorization: `token ${githubToken()}` },
});

// Webhook signature verification
const stripeWebhookSecret = secret("StripeWebhookSecret");
stripe.webhooks.constructEvent(rawBody, sig, stripeWebhookSecret());

// Connecting to a third-party SDK
const openaiKey = secret("OpenAIKey");
const openai = new OpenAI({ apiKey: openaiKey() });

Guidelines

指南

Always declare
```
secret(...)
```
at package level, never inside functions.
Read with a function call:
```
stripeKey()
```
not
```
stripeKey
```
.
Set distinct values per environment via
```
encore secret set --type <env>
```
.
Never commit secret values; use
```
.secrets.local.cue
```
for local overrides and gitignore it.
For webhook signature secrets specifically, see also the
```
encore-webhook
```
skill.

始终在包级别声明
```
secret(...)
```
，切勿在函数内部声明。
通过函数调用读取：
```
stripeKey()
```
，而不是
```
stripeKey
```
。
使用
```
encore secret set --type <env>
```
为各个环境设置不同的值。
切勿将 Secret 值提交到版本控制；本地覆盖应使用
```
.secrets.local.cue
```
，并将其加入 gitignore。
对于 Webhook 签名 Secret，请同时参阅
```
encore-webhook
```
skill。