Services

Vars and secrets

Configuration in env, changed without a deployment.

A service reads its configuration from env. Vars are plain strings that the API returns; secrets are encrypted and never returned. Both apply to the running version at once, and a name is a var or a secret, not both.

Secrets

http

PUT    /api/services/<name>/secrets/<NAME>   {"value": "..."}   → 204
GET    /api/services/<name>/secrets                             → [{name, updated_at}]
DELETE /api/services/<name>/secrets/<NAME>                      → 204

The service must exist: deploy it first. Secrets are encrypted with AES-256-GCM, bound to their service, and decrypted only to start its process.

Vars

Vars come from the deployment ("vars"), or are set on the service:

http

PUT    /api/services/<name>/vars/<NAME>   {"value": "..."}   → 204
GET    /api/services/<name>/vars                             → [{name, value, updated_at}]
DELETE /api/services/<name>/vars/<NAME>                      → 204

A var set on the service goes over the deployment's var of the same name; deleting it brings the deployment's back.

Limits

Up to 100 vars and 100 secrets per service, 64 KB each.

PreviousDeploy NextOperate