Menu
Manage API keys, credentials, and other secrets in Encore.ts using `secret(...)` from `encore.dev/config`.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Define typed API endpoints in Encore.ts using `api(...)` from `encore.dev/api`. Covers typed request/response interfaces, path/query/header/cookie params, request validation, and `APIError`. For raw endpoints (`api.raw()`) and inbound webhooks, use `encore-webhook` instead.
Protect Encore.ts endpoints with authentication and authorize callers. Covers `authHandler`, `Gateway`, `getAuthData`, and `auth: true`.
Store unstructured files in Encore.ts using `Bucket` from `encore.dev/storage/objects` — uploads, images, documents, blobs.
Cache data in Redis from Encore.ts using `CacheCluster` and typed keyspaces from `encore.dev/storage/cache`. Type-safe key/value access with TTLs, atomic increments, and per-keyspace data shapes.
Review existing Encore.ts code for best practices and common anti-patterns.
Schedule periodic / recurring work in Encore.ts using `CronJob` from `encore.dev/cron`. Covers `every: "1h"` interval syntax and `schedule: "0 9 * * 1"` cron expressions.
| name | encore-secret |
| description | Manage API keys, credentials, and other secrets in Encore.ts using `secret(...)` from `encore.dev/config`. |
| when_to_use | User wants to load a private credential into the service without committing it to the repo — third-party API keys (Stripe, OpenAI, Twilio, SendGrid), database passwords, signing keys, OAuth client secrets, JWT signing keys, webhook signing secrets. Covers `secret()` declarations, calling the secret as a function to read its value, setting values via `encore secret set`, and `.secrets.local.cue` for local overrides. Trigger phrases: "API key", "third-party token", "credentials", "without committing", "private key", "signing secret", "secret manager", ".env replacement", "encore secret set". |
Secrets are encrypted, environment-scoped values managed by Encore. Declare them at package level by calling secret(name) and read them by calling the returned function.
import { secret } from "encore.dev/config";
// Package-level declaration
const stripeKey = secret("StripeSecretKey");
// Read inside a handler
async function chargeCustomer() {
const key = stripeKey(); // <-- function call returns the value
const stripe = new Stripe(key);
// ...
}
Secret names are globally unique across the application (the same name resolves to the same value everywhere).
# Set per environment type
encore secret set --type prod StripeSecretKey
encore secret set --type dev StripeSecretKey
encore secret set --type local StripeSecretKey
Environment types: production (alias prod), development (alias dev), preview (alias pr), local.
For local development without going through encore secret set, create a .secrets.local.cue file at the repo root (gitignore it):
StripeSecretKey: "sk_test_local_..."
GitHubAPIToken: "ghp_local_..."
// HTTP headers
const githubToken = secret("GitHubAPIToken");
const resp = await fetch("https://api.github.com/user", {
headers: { Authorization: `token ${githubToken()}` },
});
// Webhook signature verification
const stripeWebhookSecret = secret("StripeWebhookSecret");
stripe.webhooks.constructEvent(rawBody, sig, stripeWebhookSecret());
// Connecting to a third-party SDK
const openaiKey = secret("OpenAIKey");
const openai = new OpenAI({ apiKey: openaiKey() });
secret(...) at package level, never inside functions.stripeKey() not stripeKey.encore secret set --type <env>..secrets.local.cue for local overrides and gitignore it.encore-webhook skill.