Secrets

Keep API keys and passwords out of your function code. Save them once as workspace secrets and read them as axis.env.NAME.

A secret is a value your functions need but should never be written in the code — an API key, a password, a signing key. You save it once for the workspace and every function reads it by name.

Before you start: anyone who can open Functions sees the secret names. Adding, replacing and deleting secrets needs Full control on Custom code. If you don't see this yet, the owner applies the waiting workspace upgrade — see Upgrade your workspace.

Add a secret

  1. Open Functions and click Secrets in the header.
  2. Type a Name in UPPER_SNAKE_CASE, for example GST_API_KEY.
  3. Paste the Value.
  4. Click Save secret. You see "GST_API_KEY saved".

Saving a name that already exists replaces its value.

Use it in code

Read the secret as axis.env.NAME:

function handler(input) {
  const key = axis.env.GST_API_KEY
  // use key …
  return { ok: !!key }
}

A name that does not exist reads as undefined.

What keeps secrets safe

  • Values are encrypted when saved and never shown again — not in the list, not to the person who saved them.
  • If a value turns up in an error message or a log line, it is masked.
  • The list shows each name and when it was last set.

Delete a secret

Click the delete icon next to it and confirm. Functions that read it will get undefined.