Configure Function Secrets

Function Secrets store private credentials and make them available to your Function without exposing them in browser code. Use Secrets for Table write keys, server API keys, and credentials for external services.

Save a Function Secret

1. Open Functions → your Function → Secrets.
2. Enter a Secret name such as TABLE_API_URL, TABLE_WRITE_KEY, or EXTERNAL_API_KEY.
3. Enter the value and choose Add / Update. Copying the value into a public code example is not necessary.
4. Reference the Secret by name from the Function’s env argument.
5. Test the Function, then Publish again when the live Function should use the new Secret set.

Saved Secret values are not displayed back to users. The list shows names and update information. Store a recoverable copy in your own secure credential manager when appropriate.

Use Secrets in Function code

export default {
  async fetch(request, env) {
    if (request.method !== "GET") {
      return Response.json({ error: "Method not allowed" }, { status: 405 });
    }
    // Add member/role authorization here if this is private data.
    const response = await fetch(env.TABLE_API_URL + "?limit=25", {
      headers: { "x-miniup-write-key": env.TABLE_WRITE_KEY }
    });
    if (!response.ok) {
      return Response.json({ error: "Data unavailable" }, { status: 502 });
    }
    const data = await response.json();
    return Response.json({ count: data.records.length });
  }
};

This example returns only a count. Decide whether that result is public before choosing Public access. For a Developer API Table key, use the Table’s x-miniup-api-key contract instead.

Update or remove a Function Secret

Use Add / Update with the existing name to replace its value. Use Delete to remove a Secret. Publish again to update live behavior; saving or deleting a Secret alone does not update the live Function’s Secret set. Test all callers after a credential rotation.

Keep private data private

Browser → Function → Secret-backed private service

Never return Secrets in a response, bootstrap configuration, error message, or log you expose to users. Do not place Secrets in Site HTML, JavaScript, public Function documentation, or AI prompts.

Related guides

• Function publishing lifecycle
• Backend authorization
• Complete member dashboard example